# ufw or iptables module **URL:** \ **Category:** Ansible Project\ **Tags:** ansible-project\ **Created:** [February 11, 2013, 2:29am UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332 "2013-02-11T02:29:11Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [February 11, 2013, 2:29am UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/1 "2013-02-11T02:29:11Z")
I'm conceptually interested, though I think there is a reason iptables is \*typically\* best managed by a template and then issuing a service load command. (Namely, expressing rules some other way is a little difficult, because there is so much you can do). Curious what you had in mind? Note Fedora18 is apparently going to Firewalld -- haven't tried it yet. I like the idea of being able to easily punch holes in firewalls. I think Seth Vidal was using lokkit in his playbooks for this purpose. --Michael ---
**Author:** ![Ahmad\_Khayyat](https://avatars.discourse-cdn.com/v4/letter/a/858c86/32.png) [@Ahmad\_Khayyat](https://forum.ansible.com/u/Ahmad_Khayyat)\ **Post date:** [February 11, 2013, 8:40am UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/2 "2013-02-11T08:40:49Z")
I use shorewall to manage iptables, and rely on its support for a rules.d directory. In /etc/shorewall/rules: SHELL cat /etc/shorewall/rules.d/\*.rules Then, each service that needs a port open installs its own rule file, e.g.: /etc/shorewall/rules.d/ssh.rules Shorewall’s formats are simple enough to manage with templates. ---
**Author:** ![Oscar\_Korz](https://avatars.discourse-cdn.com/v4/letter/o/ebca7d/32.png) [@Oscar\_Korz](https://forum.ansible.com/u/Oscar_Korz)\ **Post date:** [February 11, 2013, 7:55pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/3 "2013-02-11T19:55:42Z")
I haven’t though too much into how to do this task yet. It’s an outstanding action item for what I need to maintain with ansible. In the past when I used chef, I did indeed use a template to generate a shell script. Conceptually, I like that there’s an authorized\_keys module. I don’t want to be bothered with generating the actual file, I just want to describe what keys I do and do not want on this host. I’d like to create a ufw module that provides a similarly clean abstraction. My organization is currently using ufw to maintain the firewall rules, so if I’m going to be developing something (which it sounds like I will be doing), then I will be targeting this. However, this is my first exposure to ufw so I’m not sure of the best way to manage this. It appears that ufw uses iptables rules files, so I suppose I could just template this. The assemble module looks interesting as well. However, I think I could also use ufw directly, taking advantage of --dry-run to determine whether or not this task will be “ok” or “changed”. Do any other modules spawn child processes, or are most things done in process with pure Python? I’m very open to suggestions about this, if people have any opinions. To be honest, I think I’m just excited about an opportunity to learn more about ufw and ansible. I’m naturally curious about my systems and tools. ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [February 11, 2013, 7:58pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/4 "2013-02-11T19:58:37Z")
> It appears that ufw uses iptables rules files, so I suppose I could just > template this. The assemble module looks interesting as well. However, I > think I could also use ufw directly, taking advantage of --dry-run to > determine whether or not this task will be "ok" or "changed". Do any other > modules spawn child processes, or are most things done in process with pure > Python? I'm very open to suggestions about this, if people have any > opinions. It's totally ok for them to call other shell commands, and many modules do. Main thing is only to call them to change things when a change is needed (basic idempotency stuff). > To be honest, I think I'm just excited about an opportunity to learn more > about ufw and ansible. I'm naturally curious about my systems and tools. Cool! ---
**Author:** ![Ben\_Hood](https://avatars.discourse-cdn.com/v4/letter/b/8c91f0/32.png) [@Ben\_Hood](https://forum.ansible.com/u/Ben_Hood)\ **Post date:** [February 11, 2013, 11:04pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/5 "2013-02-11T23:04:19Z")
I’d love to see some declarative handling for iptables in ansible - I’d like to be able to declare a bunch of rules that need to exist and have the module worry about whether they currently exist or not. Having said that, I’d be intrigued as to how you delineate between asserting the existence of additional rules that aren’t already in iptables and being able to assert the entire state of the iptables (i.e. delete the entire table and reload each rule). ---
**Author:** ![Seth\_Vidal](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@Seth\_Vidal](https://forum.ansible.com/u/Seth_Vidal)\ **Post date:** [February 12, 2013, 3:37am UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/6 "2013-02-12T03:37:55Z")
I was using lokkit out of laziness and out of a desire to send a playbook to someone that would do everything w/o having to include a template file w/it. -sv ---
**Author:** ![josh2](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@josh2](https://forum.ansible.com/u/josh2)\ **Post date:** [November 6, 2013, 10:51pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/7 "2013-11-06T22:51:00Z")
This is awesome… Thank you! ---
**Author:** ![Gonzalo\_Sainz\_Trapag](https://avatars.discourse-cdn.com/v4/letter/g/dbc845/32.png) [@Gonzalo\_Sainz\_Trapag](https://forum.ansible.com/u/Gonzalo_Sainz_Trapag)\ **Post date:** [November 22, 2013, 8:04pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/8 "2013-11-22T20:04:08Z")
It seems there is an iptables frontend called “ferm” that does the trick quite nicely based on a single config file and templates. I will give it a shot and document the results afterwards, but using this might solve the issue without custom modules. ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [November 23, 2013, 2:32am UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/9 "2013-11-23T02:32:09Z")
I actually found Ferm via the Sovereign set of playbooks a while back. I just couldn’t quite make the pieces fit together well enough to write a role for it, and the one from Sovereign didn’t work for me when looked at it.. Fortunately, I found that I can template /lib/ufw/user.rules and make ufw work for me a few days ago. Templating rules that look like: ### tuple ### allow any 22 [0.0.0.0/0](http://0.0.0.0/0) any [0.0.0.0/0](http://0.0.0.0/0) in -A ufw-user-input -p tcp --dport 22 -j ACCEPT -A ufw-user-input -p udp --dport 22 -j ACCEPT ### tuple ### allow any 443 [0.0.0.0/0](http://0.0.0.0/0) any [0.0.0.0/0](http://0.0.0.0/0) in -A ufw-user-input -p tcp --dport 443 -j ACCEPT -A ufw-user-input -p udp --dport 443 -j ACCEPT Is a lot easier than FireHOL, ferm, or Shorwall’s methods. 'Course, I think my role is pretty limited in what it can do, but still, at least it makes sense to me. 🙂 My ufw role is still very rough and I’ve only tested it on a vagrant vm, so I don’t really have anything to share. But at least you all know it’s possible. 🙂 ---
**Author:** ![James\_Martin2](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@James\_Martin2](https://forum.ansible.com/u/James_Martin2)\ **Post date:** [November 25, 2013, 3:02pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/10 "2013-11-25T15:02:43Z")
I have been using a home-grown ufw module for a while. Just today I decided to submit a pull request to get it pulled in to ansible: [https://github.com/ansible/ansible/pull/5048](https://github.com/ansible/ansible/pull/5048) Please test, comment, add feature requests, etc. - James ---
**Author:** ![Gaston\_Sanchez](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@Gaston\_Sanchez](https://forum.ansible.com/u/Gaston_Sanchez)\ **Post date:** [April 23, 2014, 8:00pm UTC](https://forum.ansible.com/t/ufw-or-iptables-module/12332/11 "2014-04-23T20:00:06Z")
Now there is an ufw module. [http://docs.ansible.com/ufw\_module.html](http://docs.ansible.com/ufw_module.html)