Ansible: firewalld and adding new zone

Question

I' trying to add the following to an Ansible playbook:

firewall-cmd --permanent --new-zone dockerc
firewall-cmd --permanent --zone dockerc --add-source 172.17.0.0/16
firewall-cmd --permanent --zone dockerc --add-port 8443/tcp
firewall-cmd --permanent --zone dockerc --add-port 53/udp

But according to http://docs.ansible.com/ansible/firewalld_module.html zones do not have an option to add a new zone.

Does anyone know if its possible to add dockerc as a new zone using Ansible?

You can always just run firewall-cmd using the command or shell modules — SztupY, Feb 17 '17 at 12:09
@Magick Could you maybe change the accepted answer? The currently accepted is not valid anymore. The module can now create new zones. I just tested it (the second answer). Thanks :) — Lukas Kalbertodt, Sep 21 '20 at 14:52

score 12 · Accepted Answer · answered Jun 27 '18 at 11:36

As of 2017-12-12, specifically commit 8475171f67f, the firewalld module supports the creation (and deletion) of zones.

- firewalld:
    zone: custom
    state: present
    permanent: true

Set state to present or absent, and ensure that zone, state, and permanent are the only keys in the task.

Notes from the source code

Zone transactions (creating, deleting) can be performed by using only the zone and state parameters "present" or "absent". Note that zone transactions must explicitly be permanent. This is a limitation in firewalld. This also means that you will have to reload firewalld after adding a zone that you wish to perfom immediate actions on. The module will not take care of this for you implicitly because that would undo any previously performed immediate actions which were not permanent. Therefor, if you require immediate access to a newly created zone it is recommended you reload firewalld immediately after the zone creation returns with a changed state and before you perform any other immediate, non-permanent actions on that zone.

score 5 · Answer 2 · answered Feb 17 '17 at 23:34

Unfortunately the firewalld module is not suited for creating new zones. If the firewall-cmd is available on your host, then you can simply just run it separately:

- command: firewall-cmd --permanent --new-zone dockerc

Once the zone is set up you can use the module normally:

- firewalld:
    zone: dockerc
    permanent: true
    source: 172.17.0.0/16
    state: enabled

If you can't use the firewall-cmd command separately, then you are probably out of luck, as checking the source code of the module you can see that it doesn't contain code to create new zones.

Note however that this module is a Curated module inside ansible, meaning that it doesn't get full Core support. If you know python, then you are welcome to send a pull request to make this module capable of creating new zones.

Ansible: firewalld and adding new zone

2 Answers2