[But wait! The saga continues. See Part 3 for an even better, better way.]
I have found a better way to manage iptables using Ansible and ferm. See my original post on the subject for background. Here I will focus on the new technique.
A New and Improved Technique
I developed a simpler technique that uses a shared
ferm.conf file and a few host variables. Separate
ferm.conf files per role are no longer needed. It is very simple and makes use of jinja template features. It requires three steps.
First, include the following play snippet in your base role. Mine is called ‘centos’ and contains plays common to all my centos servers.
Second, add a ferm configuration template to your
base/templates directory. I recommend you name it
ferm.conf.j2. You can use this as-is or modify it fit your needs.
If you don’t want to restrict SSH access to a specific subnet then simply delete the line that begins with
saddr. If you do then make sure to add TCP port 22 to the host ports list as described in the third step.
admin_network (e.g., 192.168.1.0) and
CIDR (e.g., 24) are global and defined in the
The third and final step is to add the ports you want open to each host variable file. If, for example, the host is named dns1.example.com then its variables file would be
host_vars/dns1.example.com. The file is named after the FQDN of the host.
In the host variables file list the TCP and UDP ports you want open for that host. The format is a YAML list like this:
You can add as many ports as you want. For a port range use the colon notation as shown in this example. If you do not want a TCP port open (besides the default SSH port 22) then omit the
open_tcp_ports variable. Likewise if you don’t want any UDP ports open then simply do not include the
open_udp_ports variable in your host variables file.
Jinja2 allows you to customize Ansible in some interesting and unusual ways. In fact, with Ansible you actually have two languages: the Ansible YAML DSL and the jinja2 templating language. Mixing them can greatly simplify your playbooks as I am starting to learn.