6

我在centos 7中用ansible向firewalld添加了一些规则。但我必须重新加载 firewalld 守护程序，以便服务正常工作。有什么想法吗？

这是我的ansible代码：

- name: Add port to firewalld
  firewalld:
    port: "{{ item }}"
    permanent: yes
    state: enabled
  when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
  loop:
    - 8080/tcp
    - 8000/tcp
    - 8090/tcp
    - 8040/tcp
4

5 回答 5

9

首先with_items用于端口列表如下：

- name: Add port to firewalld
  firewalld:
    port: "{{ item }}"
    permanent: yes
    state: enabled
  when: ansible_distribution == 'CentOS' or ansible_distribution == 'Red Hat Enterprise Linux'
  loop:
    - 8080/tcp
    - 8000/tcp
    - 8090/tcp
    - 8040/tcp

如果端口不固定，您还可以使用以下代码输入端口并将其用作变量：

- hosts: localhost
  gather_facts: no
  vars_prompt:
    - name: ports
      prompt: "Enter port(s) number"
      private: no
  tasks:
    - name: add port
      firewalld:
            service: "{{ item }}"
            permanent: yes
            immediate: yes
            state: enabled
      with_items: "{{ ports.split(',') }}"

关于重新加载firewalld，这里提到了我们不能使用状态参数重新加载firewalld所以使用systemd模块如下：

- name: reload service firewalld
  systemd:
    name: firewalld
    state: reloaded
于 2020-03-02T19:56:08.313 回答
5

firewalld module has immediate option which is performing the same reload within firewall-cmd cli tool.

- name: Add port to firewalld
  firewalld:
    port: "{{ item }}"
    permanent: yes
    state: enabled
    immediate: true
于 2020-10-08T13:02:10.850 回答
4

您可以使用服务或 systemd 模块。

#Supports init systems include BSD init, OpenRC, SysV, Solaris SMF, systemd, upstart.
- name: Restart service 
  service:
    name: firewalld
    state: restarted

#Controls systemd services on remote hosts.
- name: Restart service 
  systemd:
    state: restarted
    daemon_reload: yes
    name: firewalld
于 2020-03-02T14:17:31.857 回答
3

我有点晚了，但鉴于所有以前的答案似乎只是推测我会提供另一个输入。Firewalld 不会使用“服务”或“systemctl”命令重新加载，而是使用它自己的特定命令重新加载：

firewall-cmd --reload

This is because that way you can load new rules without interrupting any active network connections as would be the case when using iptables directly. Given this I think using service or systemctl is not a good solution. So if you just want to create a task I suggest using the command module from ansible to execute this command. Or you could write a handler like so:

- name: reload firewalld
  command: firewall-cmd --reload

Just put the handler in the handlers/main.yml file inside your role. Then in your tasks you can call that handler with:

notify: reload firewalld

That way Ansible only executes the handler at the end of your Ansible run. I successfully tested this on RHEL7.

于 2020-09-08T14:27:10.560 回答
0

You already got a number of excellent answers. There is yet another possible approach (although the reloading part is the same as in cstoll's answer).

If you are certain that nobody and nothing else but Ansible will ever manipulate firewalld rules, you can use a template to directly generate the zone XML files in /etc/firewalld/zones . You will still need to add

notify: reload firewalld

and the corresponding handler, as in cstoll's answer.

The main advantage of this approach is that it can be dramatically faster and simpler than adding the rules one at a time.

The drawback of this approach is that it will not preserve any rules added to firewalld outside of Ansible. A second drawback is that it will not do any error checking; you can create invalid zone files easily. The firewall-cmd command (and thus the firewalld module) will verify the validity of each rule. For instance, it checks that zones do not overlap.

于 2020-11-29T02:00:57.217 回答