Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
The ansible firewalld module is great for adding rules, but old rules are left in place.
How can I achieve a guaranteed final state using the firewalld module?
Specifically, I would like a role that results in each host having identical firewall rules, regardless of their initial state and without having to know all previous rules.
I have tried setting a zone to absent, and then back to present, but this is not allowed for built-in zones.
You could make a playbook (not part of a role or anything else) which uses some sort of logic to do the follow steps:
Turn off and disable the firewall.
Check that it's really disabled (as you have the possibility of locking yourself out of the host).
Reset the firewall and clear all rules.
Apply the new rules.
Turn on and enable the firewall.
