27
Ansible iptables best practices? (sh.itjust.works)
submitted 2 years ago* by to c/selfhosted@lemmy.world
19 comments fedilink hide all child comments
 

I am currently looking into ansibles to store my configurations and deploy services more easily.

I have couple of iptable rules in /etc/iptables/rules.v4, which I can easily restore. Meanwhile, ansible has iptable role for configurations - hence, I am confused on what approach to take.

How do I persist this rules, especially across reboots? Should I rerun ansible every time on each reboot? I am at loss on how to best manage iptables, as other services can interact with it. How do you folks handle this? Thanks in advance!

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 years ago (6 children)

I have used both, can tell you that a template file of /etc/iptables/rules.v4 with iptables-persistent is the easiest way.

if you go the full IaC route and have vars for the rules, remember to get iptables to save its state after you have applied your rules

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] [S] 1 point 2 years ago (5 children)

    Thank you! Templating rules.v4 is a pretty attractive option. Though my VPS has some portions of the file which should be unmodified, so I would have to avoid this method.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 2 years ago (4 children)

    That's the point of the template, you change the bits the need change and the bits that are static get templated

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 1 point 2 years ago* (3 children)

    How do I keep some of the existing firewall rules (which is dependent on host) in the remote file, and change the other parts?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    You could either copy them to the top of your template, or you could take a look at the blockinfile module

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •