3

I'm currently working on a Ansible playbook that attempts to install and start the iptables firewall on a CentOS 6.8 minimal install. I'm doing the following in Ansible.

### sets up FW pkgs
- name: Install FW packages
  hosts: elasticsearch-servers
  become: yes

  tasks:
    - name: install ipset
      yum: name={{ item }} state=present
      with_items:
        - ipset
        - iptables

    - name: start iptables service
      service: name=iptables state=started enabled=yes

This however results in this:

TASK [start iptables service] **************************************************
fatal: [10.40.3.246]: FAILED! => {"changed": false, "failed": true, "msg": "iptables: No config file.[WARNING]\r\n"}
fatal: [10.40.3.254]: FAILED! => {"changed": false, "failed": true, "msg": "iptables: No config file.[WARNING]\r\n"}
fatal: [10.40.3.164]: FAILED! => {"changed": false, "failed": true, "msg": "iptables: No config file.[WARNING]\r\n"}
4

So this appears to be a problem that showed up after CentOS 6.5. There's this customer portal topic on it, titled: iptables failed to start in Red Hat Enterprise Linux 6.6 and above versions of minimal installation..

The direct problem is the absence of the /etc/sysconfig/ip* files that the iptables service requires to start. You can force the creation of these files by running a service iptables save, however out of the box this will fail too, because kernel modules are required in order to run service iptables save.

This is a bit of a catch 22!

The easiest way to work around this is by inducing the loading of these 2 kernel modules:

  • iptables_filter
  • ip_tables

by running a iptables command:

$ iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

You'll see the modules loaded now:

$ lsmod | grep iptable
iptable_filter          2793  0
ip_tables              17831  1 iptable_filter

You can then do a service iptables save to get the missing files created, and thus start the iptables service.

Ansible

The above is interesting but not really very friendly to doing through Ansible, without enlisting the help of the command: and shell: modules.

However we can use the modules: module in Ansible to guarantee the loading/unloading of kernel modules.

For example:

### sets up FW pkgs
- name: Install FW packages
  hosts: elasticsearch-servers
  become: yes

  tasks:
    - name: install ipset
      yum: name={{ item }} state=present
      with_items:
        - ipset
        - iptables

    # these next 2 tasks work around issue with iptables RPM in CentOS 6.5+
    # REF: https://access.redhat.com/solutions/1361093
    - name: load ip_tables kernel module
      modprobe: name=iptable_filter state=present

    - name: initial save iptables generate files
      command: /sbin/service iptables save
      args:
        warn: false

    - name: start iptables service
      service: name=iptables state=started enabled=yes

In the above we're making sure that the iptable_filter is present before we attempt to do the save.

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.