# What is the best way to manage firewalls with Ansible? **URL:** \ **Category:** Ansible Project\ **Created:** [October 7, 2013, 11:10pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624 "2013-10-07T23:10:31Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [October 7, 2013, 11:10pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/1 "2013-10-07T23:10:31Z")
So far I’ve found a few tools that let me manage linux firewalls. - iptables - ufw - shorewall - ferm I’m not skilled with any of them, and ufw is the only one I’ve really used. I know enough to block everything but the ports I actually use. I’m a bit fuzzy on firewalls because we have a very good hardware firewall in place that I don’t manage. Adding firewalls to each VM is me being extra careful. Both iptables and ufw appear to operate by running commands on the command line. So I could do that via the command or shell module. That means I’d end up running the firewall commands every time I run my Ansible playbooks. And I think I’d end up restarting the firewall every time as well. Both of those things don’t seem like good things to do. Am I right in that? Or would it be perfectly fine to run the commands and restart the firewall every time I run Ansible? Shorewall and ferm appear to use config files to set the rules, then they run the iptables commands for you from them. At least I think that’s how they work. That would let me use templates for the config file. I like that. But I don’t like how complicated the files are. Both projects documentation is kind of hard to figure out where to start. I did fine the start of a ufw module ([https://groups.google.com/d/topic/ansible-project/I1Vd3oPBfFw/discussion](https://groups.google.com/d/topic/ansible-project/I1Vd3oPBfFw/discussion)), but it doesn’t look like it’s going anywhere. What other options are there? What do you do? ---
**Author:** ![Luke\_Tislow1](https://avatars.discourse-cdn.com/v4/letter/l/cab0a1/32.png) [@Luke\_Tislow1](https://forum.ansible.com/u/Luke_Tislow1)\ **Post date:** [October 8, 2013, 12:38am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/2 "2013-10-08T00:38:24Z")
I’d say whatever your external rules are will cover that, the rest of the requirements should be on your internal side. Do you manage your internal networks and adjust firewalls? -luke ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [October 8, 2013, 2:49am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/3 "2013-10-08T02:49:27Z")
Yes, the firewall also manages internal DMZ’s. We are protected quite well, adding the firewall to the VM’s on our network is just on extra step to be as secure as possible. I do have a few VM’s outside the main firewall, on those I’m currently using ufw. So the main point of my post was just to get a general idea of how others are managing firewalls with Ansible. ---
**Author:** ![kahlil.hodgson](https://avatars.discourse-cdn.com/v4/letter/k/b9bd4f/32.png) [@kahlil.hodgson](https://forum.ansible.com/u/kahlil.hodgson)\ **Post date:** [October 8, 2013, 3:43am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/4 "2013-10-08T03:43:38Z")
I'm using shorewall for all my VMs. It's kinda overkill for a single nic, but I find it works quite well with ansible. The configuration for VMs with a single nic is very basic. The files    shorewall.conf (1 one setting changed from default)    policy (3 lines)    zones (2 lines)    interfaces (1 line) are somewhat trivial and identical across all VMs. The    rules (3 - 10 lines) file is where the ingress and egress filtering is controlled and is easily templated. I also 'chain' handlers as follows to ensure modifications don't leave iptables in a bad state: tasks:     ....     notify: check shorewall     .... handlers:     - name: check shorewall       command: /sbin/shorewall check       notify: restart shorewall     - name: restart shorewall       action: service name=shorewall state=restarted I'm happy to provide some initial content to get you started. Cheers, K Kahlil (Kal) Hodgson GPG: C9A02289 Head of Technology (m) +61 (0) 4 2573 0382 DealMax Pty Ltd (w) +61 (0) 3 9008 5281 Suite 1415 401 Docklands Drive Docklands VIC 3008 Australia "All parts should go together without forcing. You must remember that the parts you are reassembling were disassembled by you. Therefore, if you can't get them together again, there must be a reason. By all means, do not use a hammer." -- IBM maintenance manual, 1925 ---
**Author:** ![Guillaume\_Subiron](https://avatars.discourse-cdn.com/v4/letter/g/c77e96/32.png) [@Guillaume\_Subiron](https://forum.ansible.com/u/Guillaume_Subiron)\ **Post date:** [October 8, 2013, 1:15pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/5 "2013-10-08T13:15:36Z")
I also think shorewall is a good way to deploy firewall configuration using ansible. I tried to use iptables-persitent, but shorewall allows to split the rules in many files. Using run-parts in /etc/shorewall/rules, you can put any file in rules.d/. So in my "common" playbook, I only deploy common rules (close everything by default, allow ping and ssh). Then, each roles can add some rules. The "webserver" role, for instance, adds a rule file to open HTTP and HTTP ports. You just have to pay attention to the order in which the files will be executed. Le 13/10/08 14:43, Kahlil Hodgson claviotta : ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 8, 2013, 3:09pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/6 "2013-10-08T15:09:18Z")
Generally speaking, I like to do the following with iptables {% if ‘webservers’ in group\_names %} section of iptables config for webservers {% endif %} And just template the config file, and set up a notify to reload iptables when it changes. I should also point out there is a firewalld module in the devel branch now too. ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [December 12, 2014, 2:41am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/7 "2014-12-12T02:41:23Z")
So, to resurrect an old topic… And remind myself why I like having a hardware firewall covering my behind… I’ve about figured out how to use the UFW module correctly. Which makes me happy. Unfortunately, I have to administer SLES and CentOS vm’s as well. I was going to use the firewalld module, but then I couldn’t find a firewalld package in the repos to install… That leaves me kind of hanging… CentOS has /etc/sysconfig/iptables if I knew iptables. Not sure if SLES has a decent command line interface I could use… It does use a GUI tool, and force me to install a GUI on the server, so I might just run them manually… Anyway, apologies for the rambling, it’s the end of the day for me. Here are my questions: Has anyone looked at creating an iptables module that would just work on all OS’s that have Python and iptables? Maybe make the most common stuff easy, and then have a way for people to input a full iptables command? So, for people running simple stuff, like me, could make a task like iptables: ports=“22,2222” proto=“tcp,udp” allowed\_from=“[10.0.0.0/8](http://10.0.0.0/8)” allowed\_to=“everywhere” More complicated stuff could be: iptables: command=“stuff that is currently gibberish to me” Micheal, you mentioned a config file, which one were you talking about? Is there a way to install firewalld that my google-fu missed? Or even ufw? Is there a really good introduction to iptables that you would recommend? Since the obvious route to solve my problem is to suck it up and learn iptables… Thanks! ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [December 12, 2014, 2:54am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/8 "2014-12-12T02:54:37Z")
"CentOS has /etc/sysconfig/iptables if I knew iptables. " Learning iptables config is not hard actually, nor is templating it. It can be used for very complex things ([http://www.ex-parrot.com/pete/upside-down-ternet.html](http://www.ex-parrot.com/pete/upside-down-ternet.html)) but simple accept/deny rules are straightforward You just write the iptables config file and then have to do /sbin/service iptables restart to make it “apply” Google “manage iptables” and you should be able to find some good examples. I can’t say I have any specific tutorials or references that I like, but others may have some good ones. So anyway, hopefully at least good for some encouragement! ---
**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\ **Post date:** [December 12, 2014, 3:41am UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/9 "2014-12-12T03:41:42Z")
if you need a GUI, firewall builder [http://www.fwbuilder.org/](http://www.fwbuilder.org/) is a desktop app that can generate iptables rules (among others), you can use it to get the commands for your templates. Though iptables is not hard the syntax can get clunky, the new linux fireall system, nftables, is much nicer and with clearer sytnax, it seems to borrow some good things from BSD's pf (packet filter). It might not be available to you yet. ---
**Author:** ![David\_Reagan](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@David\_Reagan](https://forum.ansible.com/u/David_Reagan)\ **Post date:** [December 12, 2014, 7:13pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/10 "2014-12-12T19:13:44Z")
@Michael I assume you are templating the /etc/sysconfig/iptables in CentOS, and /etc/iptables/rules.v4 in Ubuntu files? I just figured out that you can install the iptables-persistent package in Ubuntu, I hadn’t been sure what files you were referring to before that… So, a reload on CentOS would be `service iptables restart`. What about Ubuntu? `cat /etc/iptables/rules.v4 | iptables-restore` ? @Brian, I took a look at fwbuilder. Looks almost as complicated as iptables itself. At least for my limited needs. Maybe if I was doing something more complicated… Thanks for the tip. ---
**Author:** ![Michel\_Blanc](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@Michel\_Blanc](https://forum.ansible.com/u/Michel_Blanc)\ **Post date:** [December 12, 2014, 10:04pm UTC](https://forum.ansible.com/t/what-is-the-best-way-to-manage-firewalls-with-ansible/13624/11 "2014-12-12T22:04:26Z")
Hi David & list, > @Michael I assume you are templating the /etc/sysconfig/iptables in > CentOS, and /etc/iptables/rules.v4 in Ubuntu files? I just figured out > that you can install the iptables-persistent package in Ubuntu, I hadn't > been sure what files you were referring to before that... You can also simply do in /etc/network/interfaces : ... iface eth0 inet static     pre-up iptables-restore \< /etc/network/iptables     ... without resorting to iptables-persistent. > So, a reload on CentOS would be ```service iptables restart```. What > about Ubuntu? ```cat /etc/iptables/rules.v4 | iptables-restore``` ? For this, I have a flush script that I push with ansible, which basically does : iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT > @Brian, I took a look at fwbuilder. Looks almost as complicated as > iptables itself. At least for my limited needs. Maybe if I was doing > something more complicated... Thanks for the tip. I'll probably try "ferm" RSN. Since it supports '.d' style configuration layout (@include 'ferm.d/'), it should be really easy to integrate the necessary rules in each ansible role, without resorting to the assemble module (or worse, trying to write an omnipotent iptable rules file, been there...). [http://ferm.foo-projects.org/](http://ferm.foo-projects.org/) M