# Variables from csv and loops with random records **URL:** \ **Category:** Ansible Project\ **Created:** [January 17, 2017, 8:42am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472 "2017-01-17T08:42:36Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Matyas\_Kovacs](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@Matyas\_Kovacs](https://forum.ansible.com/u/Matyas_Kovacs)\ **Post date:** [January 17, 2017, 8:42am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/1 "2017-01-17T08:42:36Z")
Hi All, I hope you can help me with this problem. There are 50 different servers, each of them has different iptables firewall and rules. I want them to be managed by Ansible. My idea is to create a csv file, like this: hostname/ip, iptablesrule testmachine05, iptables -A LOGNDROP -p udp -m limit --limit 5/min -j LOG --log-prefix "Denied UDP: " --log-level 7 testmachine01, iptables -A INPUT -p tcp --dport 80 -j ACCEPT testmachine10, iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT I would use iptables\_raw module to apply the rules. ([http://blog.nordeus.com/files/libraryblog/articles/managing-iptables-with-ansible/iptables\_raw.html](http://blog.nordeus.com/files/libraryblog/articles/managing-iptables-with-ansible/iptables_raw.html)) For example: ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [January 18, 2017, 8:53am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/2 "2017-01-18T08:53:06Z")
> Hi All, > > I hope you can help me with this problem. > There are 50 different servers, each of them has different iptables > firewall and rules. I want them to be managed by Ansible. My idea is to > create a csv file, like this: I highly recommend against a csv file if you can choose. Make a variable/variable files is a lot easier to deal with. > hostname/ip, iptablesrule > testmachine05, iptables -A LOGNDROP -p udp -m limit --limit 5/min -j LOG > --log-prefix "Denied UDP: " --log-level 7 > testmachine01, iptables -A INPUT -p tcp --dport 80 -j ACCEPT > testmachine10, iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT > > I would use iptables\_raw module to apply the rules. ( > [http://blog.nordeus.com/files/libraryblog/articles/managing-iptables-with-ansible/iptables\_raw.html](http://blog.nordeus.com/files/libraryblog/articles/managing-iptables-with-ansible/iptables_raw.html) > ) > > For example: >       --- >       - hosts: all \<\< change this with variable from csv first column > (e.g. testmachin05, testmachin 10, etc.) >         tasks: > - iptables\_raw: > name=allow\_tcp\_80 > rules='-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT' \<\< change this with > variable from csv from secound column > In order to make the process of rule addition easier, is it possible to: > have Ansible run through the csv file and collect its' content into > variables? Something like this is a better alternative IMHO. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 18, 2017, 10:04am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/3 "2017-01-18T10:04:31Z")
Have a look at [https://galaxy.ansible.com/detail#/role/5878](https://galaxy.ansible.com/detail#/role/5878) ([https://github.com/mikegleasonjr/ansible-role-firewall](https://github.com/mikegleasonjr/ansible-role-firewall)) I used this in my setup. Basically you setup three different lists, one for the default rules (each server has port 22 open), the group rules (each server in 'webservers' needs 80 and 443) and host rules (this server also needs this and that port). The rules get loaded so that more specific rules can (but do not have to) overwrite more general rules, but rather get merged. Johannes ---
**Author:** ![Matyas\_Kovacs](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@Matyas\_Kovacs](https://forum.ansible.com/u/Matyas_Kovacs)\ **Post date:** [January 19, 2017, 10:48am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/4 "2017-01-19T10:48:11Z")
Hi! Thanks for the advice, I like it. But, I have a syntax error with this: ---
**Author:** ![Matyas\_Kovacs](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@Matyas\_Kovacs](https://forum.ansible.com/u/Matyas_Kovacs)\ **Post date:** [January 19, 2017, 10:50am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/5 "2017-01-19T10:50:57Z")
In this case, I have to update a lot of file, because there are a lot of different rule on each servers. But, I have another project, where I will use this solution. Thanks! 1. január 18., szerda 11:04:37 UTC+1 időpontban Johannes Kastl a következőt írta: ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 20, 2017, 7:57am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/6 "2017-01-20T07:57:15Z")
If your existing files have valid iptables syntax, then this conversion should be scriptable... Johannes ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 20, 2017, 8:00am UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/7 "2017-01-20T08:00:20Z")
The indentation is wrong, the dash should be indented as tasks is: - hosts: all   tasks:   - iptables\_raw: [https://docs.ansible.com/ansible/playbooks\_intro.html#playbook-language-example](https://docs.ansible.com/ansible/playbooks_intro.html#playbook-language-example) ---
**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\ **Post date:** [January 20, 2017, 3:26pm UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/8 "2017-01-20T15:26:30Z")
That's not correct, both of them works in Ansible. This message to appear if the module iptables\_raw is not installed. Since iptables\_raw is not part of Ansible I quess the user hasn't installed it. ---
**Author:** ![Johannes\_Kastl](https://avatars.discourse-cdn.com/v4/letter/j/bbe5ce/32.png) [@Johannes\_Kastl](https://forum.ansible.com/u/Johannes_Kastl)\ **Post date:** [January 20, 2017, 4:20pm UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/9 "2017-01-20T16:20:40Z")
> That's not correct, both of them works in Ansible. I found no mention of this syntax when fast-reading the docs. So: Good to know. > This message to appear if the module iptables\_raw is not installed. > Since iptables\_raw is not part of Ansible I quess the user hasn't > installed it. Too bad ansible does not throw a useful error... Johannes ---
**Author:** ![Matyas\_Kovacs](https://avatars.discourse-cdn.com/v4/letter/m/a9a28c/32.png) [@Matyas\_Kovacs](https://forum.ansible.com/u/Matyas_Kovacs)\ **Post date:** [January 21, 2017, 5:17pm UTC](https://forum.ansible.com/t/variables-from-csv-and-loops-with-random-records/23472/10 "2017-01-21T17:17:49Z")
This is the right answer, thanks. The module was in a wrong folder. Now everything is OK. Thanks for everyone. 1. január 20., péntek 16:26:58 UTC+1 időpontban Kai Stian Olstad a következőt írta: