# Strange iptables\_raw + with\_together behaviour **URL:** \ **Category:** Ansible Project\ **Created:** [December 14, 2016, 5:12am UTC](https://forum.ansible.com/t/strange-iptables-raw-with-together-behaviour/23251 "2016-12-14T05:12:08Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![andrew.hudson](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@andrew.hudson](https://forum.ansible.com/u/andrew.hudson)\ **Post date:** [December 14, 2016, 5:12am UTC](https://forum.ansible.com/t/strange-iptables-raw-with-together-behaviour/23251/1 "2016-12-14T05:12:08Z")
Hi all Ive come across a quirk when using the ‘iptables\_raw’ module along with the ‘with\_together’ loop. Logically, im inserting three new iptables input rules (for ftp) and giving them a name I would expect that with\_together would assign a name to a rule in the order that they appear in a list, e.g. [a, b, c] [1, 2, 3] = a1, b2, c3 ` # Ansible task - name: Create iptables rules for ftp access iptables\_raw: name: ‘ftp\_{{ item.0 }}’ rules: “{{ item.1 }}” with\_together: - { connection, data, passive } - { ‘-A INPUT -p tcp --dport 21 -j ACCEPT’, ‘-A INPUT -p tcp --dport 20 -j ACCEPT’, ‘-A INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack --ctstate ESTABLISHED -j ACCEPT’ } ` ` # Result on target machine Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp – 0.0.0.0/0 0.0.0.0/0 tcp spts:1024:65535 dpts:1024:65535 ctstate ESTABLISHED /\* ansible[ftp\_data] _/ 2 ACCEPT tcp – 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 /_ ansible[ftp\_connection] _/ 3 ACCEPT tcp – 0.0.0.0/0 0.0.0.0/0 tcp dpt:20 /_ ansible[ftp\_passive] \*/ ` The expected output is: port 21 - connection port 20 - data spts:1024:65535 dpts:1024:65535 - passive Peculiarly, it doesn’t matter what order either list is in, the result is the same. (Another quirk of the iptables\_raw module is that the -A flag inserts at the top of the list instead of appending to the end, different to creating a rule from the command line, where -I is used to insert at the top of the list and -A appends to the end.) Ansible version 2.2.0.0 ansible host: centos 6.8 target: centos 7.2 Since I’m working with a centos7 box I’ve gone back to firewalld as a workaround. I understand the iptables\_raw module isn’t widely used and there exists an iptables module. ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [December 17, 2016, 8:50am UTC](https://forum.ansible.com/t/strange-iptables-raw-with-together-behaviour/23251/2 "2016-12-17T08:50:04Z")
> Hi all > > Ive come across a quirk when using the 'iptables\_raw' module along with the > 'with\_together' loop. > Logically, im inserting three new iptables input rules (for ftp) and giving > them a name > I would expect that with\_together would assign a name to a rule in the > order that they appear in a list, It will when you use a list and not dictionary as you using bellow. Dictionary is unordered in Python. > # Ansible task > - name: Create iptables rules for ftp access >   iptables\_raw: >     name: 'ftp\_{{ item.0 }}' >     rules: "{{ item.1 }}" >   with\_together: >     - { connection, >         data, >         passive } >     - { '-A INPUT -p tcp --dport 21 -j ACCEPT', >         '-A INPUT -p tcp --dport 20 -j ACCEPT', >         '-A INPUT -p tcp -m tcp --sport 1024: --dport 1024: -m conntrack > --ctstate ESTABLISHED -j ACCEPT' } > > # Result on target machine > Chain INPUT (policy ACCEPT) > num target prot opt source destination > 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > spts:1024:65535 dpts:1024:65535 ctstate ESTABLISHED /\* ansible[ftp\_data] \*/ > 2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > dpt:21 /\* ansible[ftp\_connection] \*/ > 3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > dpt:20 /\* ansible[ftp\_passive] \*/ > > The expected output is: > port 21 - connection > port 20 - data > spts:1024:65535 dpts:1024:65535 - passive > > Peculiarly, it doesn't matter what order either list is in, the result is > the same. You say list but are using {} instead of , I guess you will get correct result when you change to use lists.