The ansible firewalld module is great for adding rules, but old rules are left in place.

How can I achieve a guaranteed final state using the firewalld module?

Specifically, I would like a role that results in each host having identical firewall rules, regardless of their initial state and without having to know all previous rules.

I have tried setting a zone to absent, and then back to present, but this is not allowed for built-in zones.

1 Answer 1


You could make a playbook (not part of a role or anything else) which uses some sort of logic to do the follow steps:

  1. Turn off and disable the firewall.

    Check that it's really disabled (as you have the possibility of locking yourself out of the host).

  2. Reset the firewall and clear all rules.

  3. Apply the new rules.

  4. Turn on and enable the firewall.

  • This sounds like a possible solution. Is it easy to "reset the firewall and clear all rules" an in idempotent manner? I assume 'yes' but I don't know for certain.
    – 0xSheepdog
    Apr 20, 2022 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .