# iptables\_raw Module - Manage Iptables the Easy Way

**URL:** <https://forum.ansible.com/t/iptables-raw-module-manage-iptables-the-easy-way/21948>\
**Category:** Ansible Project\
**Created:** [July 7, 2016, 10:44am UTC](https://forum.ansible.com/t/iptables-raw-module-manage-iptables-the-easy-way/21948 "2016-07-07T10:44:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Strahinja\_Kustudic1](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Strahinja\_Kustudic1](https://forum.ansible.com/u/Strahinja_Kustudic1)\
**Post date:** [July 7, 2016, 10:44am UTC](https://forum.ansible.com/t/iptables-raw-module-manage-iptables-the-easy-way/21948/1 "2016-07-07T10:44:35Z")

</div>

We wrote a new module called [iptables\_raw](https://github.com/Nordeus/ansible_iptables_raw) ([docs](http://blog.nordeus.com/files/libraryblog/articles/managing-iptables-with-ansible/iptables_raw.html)) to make it easy to manage iptables. The module has the following features:

- use iptables syntax to define rules

- keep iptables state

- order rules by weigh

- support different iptables tables (filter, nat, raw,…)

- management of unmanaged rules

- ip6tables

- safe flushing of table rules

I wrote a [blog post](http://blog.nordeus.com/dev-ops/managing-iptables-with-ansible-the-easy-way.htm) which explains how we use this module and how we manage iptables with it. Give it a read, try the module and tell us what you think, feedback would be much appreciated.

---

<div class="post-metadata">

**Author:** ![Jason\_DeTiberus](https://avatars.discourse-cdn.com/v4/letter/j/43a26b/32.png) [@Jason\_DeTiberus](https://forum.ansible.com/u/Jason_DeTiberus)\
**Post date:** [July 7, 2016, 4:20pm UTC](https://forum.ansible.com/t/iptables-raw-module-manage-iptables-the-easy-way/21948/2 "2016-07-07T16:20:46Z")

</div>

Kudos on saving the state and providing locking around that state. As  
long as you can ensure that this module is the only thing manipulating  
iptables on the hosts you are managing, then there should be no  
issues. In the project I work on, we don't have that guarantee, so we  
work around it by adding a chain to minimize the possibility of  
conflicts with other services managing iptables. It doesn't completely  
solve the issue, but it has improved reliability in practice.

---

<div class="post-metadata">

**Author:** ![Strahinja\_Kustudic1](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Strahinja\_Kustudic1](https://forum.ansible.com/u/Strahinja_Kustudic1)\
**Post date:** [July 7, 2016, 4:32pm UTC](https://forum.ansible.com/t/iptables-raw-module-manage-iptables-the-easy-way/21948/3 "2016-07-07T16:32:13Z")

</div>

The module saves a complete state in /etc/ansible-iptables and we do locking, so it doesn’t matter that much if someone fiddles around the active iptables rules or if they change /etc/sysconfig/iptables file, since the first time this module is called the whole state is recreated from the state file and all rules are restored (and if keep\_unmanaged=no all unmanaged/foreign rules are dropped as well).

Of course if someone deletes the state file in /etc/ansible-iptables you would lose all your rules until you run all iptables\_raw tasks, but you shouldn’t need to touch that directory ever.