# Iptables rule --set

**URL:** <https://forum.ansible.com/t/iptables-rule-set/8744>\
**Category:** Get Help\
**Tags:** playbook\
**Created:** [September 24, 2024, 10:08pm UTC](https://forum.ansible.com/t/iptables-rule-set/8744 "2024-09-24T22:08:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![GrazyJoe](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@GrazyJoe](https://forum.ansible.com/u/GrazyJoe)\
**Post date:** [September 24, 2024, 10:08pm UTC](https://forum.ansible.com/t/iptables-rule-set/8744/1 "2024-09-24T22:08:00Z")

</div>

Hello everyone,

I’ve just started with ansible (and like it!), now I’m trying to figure out how to create this iptables rule:

_iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set_

This is the task I’ve created:

```auto
- name: Add iptables rule
  ansible.builtin.iptables:
    chain: INPUT
    protocol: tcp
    match: tcp,state
    ctstate: new 
    destination_port: '{{ sshport }}'

```

The result is:  
_iptables -I INPUT -p tcp --dport 22 -m state --state NEW_

So -m recent --set is still missing. I’ve added recent in the match parameter:

```auto
- name: Add iptables rule
  ansible.builtin.iptables:
    chain: INPUT
    protocol: tcp
    match: tcp,state,recent
    ctstate: new 
    destination_port: '{{ sshport }}'

```

But which parameter is needed for --set?

---

<div class="post-metadata">

**Author:** ![adriansev](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/adriansev/32/4866_2.png) [@adriansev](https://forum.ansible.com/u/adriansev)\
**Post date:** [September 25, 2024, 5:15am UTC](https://forum.ansible.com/t/iptables-rule-set/8744/2 "2024-09-25T05:15:35Z")

</div>

I think it’s more flexible to use the template mechanics see [template\_module](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/template_module.html)  
This would allow to always generate on target the desired iptables, and more importantly, the order of rules

---

<div class="post-metadata">

**Author:** ![GrazyJoe](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@GrazyJoe](https://forum.ansible.com/u/GrazyJoe)\
**Post date:** [September 25, 2024, 8:06am UTC](https://forum.ansible.com/t/iptables-rule-set/8744/3 "2024-09-25T08:06:30Z")

</div>

Thanks for your reply! I’m going to figure out the template\_module 😃

---

<div class="post-metadata">

**Author:** ![GrazyJoe](https://avatars.discourse-cdn.com/v4/letter/g/46a35a/32.png) [@GrazyJoe](https://forum.ansible.com/u/GrazyJoe)\
**Post date:** [September 25, 2024, 9:02pm UTC](https://forum.ansible.com/t/iptables-rule-set/8744/4 "2024-09-25T21:02:28Z")

</div>

I’ve spent some hours figuring out how to make it work, and job done!

This is what i’ve created.

Tasks:

```auto
- name: Install the iptables-persistent package
  ansible.builtin.apt:
    name: iptables-persistent
    update_cache: yes
    state: present

- name: Create temporary iptables dir
  ansible.builtin.file:
    path: /etc/iptables-tmp
    state: directory

- name: Upload iptables template
  ansible.builtin.template:
    src: templates/ssh_iptables.j2
    dest: /etc/iptables-tmp/ssh_iptables

- name: Implement connection rate throttling IPv4
  community.general.iptables_state:
    ip_version: ipv4
    state: restored
    path: /etc/iptables-tmp/ssh_iptables
    noflush: true
  async: "{{ ansible_timeout }}"
  poll: 0

- name: Implement connection rate throttling IPv6
  community.general.iptables_state:
    ip_version: ipv6
    state: restored
    path: /etc/iptables-tmp/ssh_iptables
    noflush: true
  async: "{{ ansible_timeout }}"
  poll: 0

- name: Make firewall rules persistent
  ansible.builtin.shell: |
    sudo iptables-save > /etc/iptables/rules.v4
    sudo ip6tables-save > /etc/iptables/rules.v6

- name: Remove temporary iptables dir
  ansible.builtin.file:
    path: /etc/iptables-tmp
    state: absent

```

template.j2

```auto
*filter

-I INPUT -p tcp --dport {{ sshport }} -m state --state NEW -m recent --set
-I INPUT -p tcp --dport {{ sshport }} -m state --state NEW -m recent --update --seconds 10 --hitcount 10 -j DROP

COMMIT

```

I’ve tried to use the _community.general.iptables\_state_, but it didn’t make the iptables rules persistent, that’s why i choose to use the _ansible.builtin.shell_.

```auto
- name: save current state of the firewall in system file
  community.general.iptables_state:
    ip_version: ipv6
    table: filter
    state: saved
    path: /etc/iptables/rules.v6

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [October 25, 2024, 9:02pm UTC](https://forum.ansible.com/t/iptables-rule-set/8744/5 "2024-10-25T21:02:45Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.