link管理
链接快照平台
- 输入网页链接，自动生成快照
- 标签化管理网页链接
相关文章推荐
|
踢足球的鸭蛋 · Unable to reuse ssh ...· 3 月前 · |
|
|
发怒的莲藕 · 使用变量 — Ansible 社区文档· 1 月前 · |
|
|
成熟的椰子 · Ansible自动化管理：Kodcloud搭 ...· 1 月前 · |
|
|
刀枪不入的感冒药 · when条件判断 | 编程技术分享· 1 月前 · |
|
|
英姿勃勃的警车 · Deploy a Milvus ...· 1 月前 · |
|
|
直爽的凉面 · Servlet开发 - 廖雪峰的官方网站· 1 年前 · |
|
|
好帅的西装 · 比较两个Count()值sql - 问答 ...· 2 年前 · |
|
|
文武双全的单车 · 无法从安卓设备连接到mysql· 2 年前 · |
|
|
讲道义的茶叶 · Can I launch the Snap ...· 2 年前 · |
link管理
›
ansible.builtin.iptables module – Modify iptables rules — Ansible Documentation
| match ansible |
| https://docs.ansible.com/ansible/latest/collections/ansible/builtin/iptables_module.html |
|
想出家的拐杖
2 年前 |
Contributing to Ansible
Extending Ansible
Common Ansible Scenarios
Network Automation
Ansible Galaxy
Reference & Appendices
- Collections in the Amazon Namespace
-
Collections in the Ansible Namespace
-
Ansible.Builtin
- Description
- Communication
- Plugin Index
- Ansible.Netcommon
- Ansible.Posix
- Ansible.Utils
- Ansible.Windows
- Collections in the Arista Namespace
- Collections in the Awx Namespace
- Collections in the Azure Namespace
- Collections in the Check_point Namespace
- Collections in the Chocolatey Namespace
- Collections in the Cisco Namespace
- Collections in the Cloud Namespace
- Collections in the Cloudscale_ch Namespace
- Collections in the Community Namespace
- Collections in the Containers Namespace
- Collections in the Cyberark Namespace
- Collections in the Dellemc Namespace
- Collections in the F5networks Namespace
- Collections in the Fortinet Namespace
- Collections in the Frr Namespace
- Collections in the Gluster Namespace
- Collections in the Google Namespace
- Collections in the Grafana Namespace
- Collections in the Hetzner Namespace
- Collections in the Hpe Namespace
- Collections in the Ibm Namespace
- Collections in the Infinidat Namespace
- Collections in the Infoblox Namespace
- Collections in the Inspur Namespace
- Collections in the Junipernetworks Namespace
- Collections in the Kubernetes Namespace
- Collections in the Lowlydba Namespace
- Collections in the Microsoft Namespace
- Collections in the Netapp Namespace
- Collections in the Netapp_eseries Namespace
- Collections in the Netbox Namespace
- Collections in the Ngine_io Namespace
- Collections in the Openstack Namespace
- Collections in the Openvswitch Namespace
- Collections in the Ovirt Namespace
- Collections in the Purestorage Namespace
- Collections in the Sensu Namespace
- Collections in the Servicenow Namespace
- Collections in the Splunk Namespace
- Collections in the T_systems_mms Namespace
- Collections in the Telekom_mms Namespace
- Collections in the Theforeman Namespace
- Collections in the Vmware Namespace
- Collections in the Vultr Namespace
- Collections in the Vyos Namespace
- Collections in the Wti Namespace
- Indexes of all modules and plugins
- Playbook Keywords
- Return Values
- Ansible Configuration Settings
- Controlling how Ansible behaves: precedence rules
- YAML Syntax
- Python 3 Support
- Interpreter Discovery
- Releases and maintenance
- Testing Strategies
- Sanity Tests
- Frequently Asked Questions
- Glossary
- Ansible Reference: Module Utilities
- Special Variables
- Red Hat Ansible Automation Platform
- Ansible Automation Hub
- Logging Ansible output
- Ansible Roadmap
- ansible-core Roadmaps
- Collections in the Ansible Namespace
- Ansible.Builtin
- ansible.builtin.iptables module – Modify iptables rules Edit on GitHub
-
iptablesis used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. -
This module does not handle the saving and/or loading of rules, but rather only manipulates the current rules that are present in memory. This is the same as the behaviour of the
iptablesandip6tablescommand which this module uses internally. -
"append"← (default) -
"insert" -
false← (default) -
false← (default) -
"ipv4"← (default) -
"ipv6" -
"emerg" -
"alert" -
"crit" -
"error" -
"warning" -
"notice" -
"info" -
"debug" -
"src" -
"dst" -
"src,dst" -
"dst,src" -
false← (default) -
"ACCEPT" -
"DROP" -
"QUEUE" -
"RETURN" -
"absent" -
"present"← (default) -
"ignore"← (default) -
"match" -
"negate" -
"filter"← (default) -
"nat" -
"mangle" -
"raw" -
"security" -
Linus Unnebäck (@LinusU)
-
Sébastien DA ROCHA (@sebastiendarocha)
Roadmaps
This module is part of
ansible-coreand included in all Ansible installations. In most cases, you can use the short module nameiptableseven without specifying thecollections:keyword. However, we recommend you use the FQCN for easy linking to the module documentation and to avoid conflicting with other collections that may have the same module name.Synopsis
Parameters
Parameter
Comments
Whether the rule should be appended at the bottom or inserted at the top.
If the rule already exists the chain will not be modified.
Choices:
added in ansible-core 2.13
If
trueandstateispresent, the chain will be created if needed.If
trueandstateisabsent, the chain will be deleted if the only other parameter passed arechainand optionallytable.Choices:
A list of the connection states to match in the conntrack module.
Possible values are
INVALID,NEW,ESTABLISHED,RELATED,UNTRACKED,SNAT,DNAT.Default:
[]destination
string
Destination specification.
Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address.
Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea.
The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A
!argument before the address specification inverts the sense of the address.destination_port
string
Destination port or port range specification. This can either be a service name or a port number. An inclusive range can also be specified, using the format first:last. If the first port is omitted, ‘0’ is assumed; if the last is omitted, ‘65535’ is assumed. If the first port is greater than the second one they will be swapped. This is only valid if the rule also specifies one of the following protocols: tcp, udp, dccp or sctp.
destination_ports
list / elements=string
added in ansible-core 2.11
This specifies multiple destination port numbers or port ranges to match in the multiport module.
It can only be used in conjunction with the protocols tcp, udp, udplite, dccp and sctp.
Default:
[]dst_range
string
added in Ansible 2.8
Specifies the destination IP range to match in the iprange module.
flush
boolean
Flushes the specified table and chain of all rules.
If no chain is specified then the entire table is purged.
Ignores all other parameters.
Choices:
string
This means that the rule only refers to second and further fragments of fragmented packets.
Since there is no way to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match any rules which specify them.
When the “!” argument precedes fragment argument, the rule will only match head fragments, or unfragmented packets.
gateway
string
added in Ansible 2.8
This specifies the IP address of host to send the cloned packets.
This option is only valid when
jumpis set toTEE.gid_owner
string
added in Ansible 2.9
Specifies the GID or group to use in match by owner rule.
string
This specifies that the processing should continue in a user specified chain.
Unlike the jump argument return will not continue processing in this chain but instead in the chain that called us via jump.
icmp_type
string
This allows specification of the ICMP type, which can be a numeric ICMP type, type/code pair, or one of the ICMP type names shown by the command ‘iptables -p icmp -h’
in_interface
string
Name of an interface via which a packet was received (only for packets entering the
INPUT,FORWARDandPREROUTINGchains).When the
!argument is used before the interface name, the sense is inverted.If the interface name ends in a
+, then any interface which begins with this name will match.If this option is omitted, any interface name will match.
ip_version
string
Which version of the IP protocol this rule should apply to.
Choices:
This specifies the target of the rule; i.e., what to do if the packet matches it.
The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below).
If this option is omitted in a rule (and the goto parameter is not used), then matching the rule will have no effect on the packet’s fate, but the counters on the rule will be incremented.
limit
string
Specifies the maximum average number of matches to allow per second.
The number can specify units explicitly, using
/second,/minute,/houror/day, or parts of them (so5/secondis the same as5/s).limit_burst
string
Specifies the maximum burst before the above limit kicks in.
log_level
string
added in Ansible 2.8
Logging level according to the syslogd-defined priorities.
The value can be strings or numbers from 1-8.
This parameter is only applicable if
jumpis set toLOG.Choices:
list / elements=string
Specifies a match to use, that is, an extension module that tests for a specific property.
The set of matches make up the condition under which a target is invoked.
Matches are evaluated first to last if specified as an array and work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.
Default:
[]match_set
string
added in ansible-core 2.11
Specifies a set name which can be defined by ipset.
Must be used together with the match_set_flags parameter.
When the
!argument is prepended then it inverts the rule.Uses the iptables set extension.
match_set_flags
string
added in ansible-core 2.11
Specifies the necessary flags for the match_set parameter.
Must be used together with the match_set parameter.
Uses the iptables set extension.
Choices:
added in ansible-core 2.15
This parameter controls the running of the list -action of iptables, which is used internally by the module
Does not affect the actual functionality. Use this if iptables hangs when creating chain or altering policy
If
true, then iptables skips the DNS-lookup of the IP addresses in a chain when it uses the list -actionListing is used internally for example when setting a policy or creting of a chain
Choices:
string
Name of an interface via which a packet is going to be sent (for packets entering the
FORWARD,OUTPUTandPOSTROUTINGchains).When the
!argument is used before the interface name, the sense is inverted.If the interface name ends in a
+, then any interface which begins with this name will match.If this option is omitted, any interface name will match.
policy
string
Set the policy for the chain to the given target.
Only built-in chains can have policies.
This parameter requires the
chainparameter.If you specify this parameter, all other parameters will be ignored.
This parameter is used to set default policy for the given
chain. Do not confuse this withjumpparameter.Choices:
The protocol of the rule or of the packet to check.
The specified protocol can be one of
tcp,udp,udplite,icmp,ipv6-icmporicmpv6,esp,ah,sctpor the special keywordall, or it can be a numeric value, representing one of these protocols or a different one.A protocol name from /etc/protocols is also allowed.
A
!argument before the protocol inverts the test.The number zero is equivalent to all.
allwill match with all protocols and is taken as default when this option is omitted.reject_with
string
Specifies the error packet type to return while rejecting. It implies “jump: REJECT”.
rule_num
string
Insert the rule as the given rule number.
This works only with
action=insert.set_counters
string
This enables the administrator to initialize the packet and byte counters of a rule (during
INSERT,APPEND,REPLACEoperations).set_dscp_mark
string
This allows specifying a DSCP mark to be added to packets. It takes either an integer or hex value.
Mutually exclusive with
set_dscp_mark_class.set_dscp_mark_class
string
This allows specifying a predefined DiffServ class which will be translated to the corresponding DSCP mark.
Mutually exclusive with
set_dscp_mark.source
string
Source specification.
Address can be either a network name, a hostname, a network IP address (with /mask), or a plain IP address.
Hostnames will be resolved once only, before the rule is submitted to the kernel. Please note that specifying any name to be resolved with a remote query such as DNS is a really bad idea.
The mask can be either a network mask or a plain number, specifying the number of 1’s at the left side of the network mask. Thus, a mask of 24 is equivalent to 255.255.255.0. A
!argument before the address specification inverts the sense of the address.source_port
string
Source port or port range specification.
This can either be a service name or a port number.
An inclusive range can also be specified, using the format
first:last.If the first port is omitted,
0is assumed; if the last is omitted,65535is assumed.If the first port is greater than the second one they will be swapped.
src_range
string
added in Ansible 2.8
Specifies the source IP range to match in the iprange module.
state
string
Whether the rule should be absent or present.
Choices:
string
This allows matching packets that have the SYN bit set and the ACK and RST bits unset.
When negated, this matches all packets with the RST or the ACK bits set.
Choices:
string
This option specifies the packet matching table which the command should operate on.
If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.
Choices:
string
This specifies a destination port or range of ports to use, without this, the destination port is never altered.
This is only valid if the rule also specifies one of the protocol
tcp,udp,dccporsctp.to_source
string
This specifies a source address to use with
SNAT.Without this, the source address is never altered.
uid_owner
string
Specifies the UID or username to use in match by owner rule.
From Ansible 2.6 when the
!argument is prepended then the it inverts the rule to apply instead to all users except that one specified.string
added in ansible-base 2.10
Wait N seconds for the xtables lock to prevent multiple instances of the program from running concurrently.
- name : Allow related and established connections ansible.builtin.iptables : chain : INPUT ctstate : ESTABLISHED,RELATED jump : ACCEPT become : yes - name : Allow new incoming SYN packets on TCP port 22 (SSH) ansible.builtin.iptables : chain : INPUT protocol : tcp destination_port : 22 ctstate : NEW syn : match jump : ACCEPT comment : Accept new SSH connections. - name : Match on IP ranges ansible.builtin.iptables : chain : FORWARD src_range : 192.168.1.100-192.168.1.199 dst_range : 10.0.0.1-10.0.0.50 jump : ACCEPT - name : Allow source IPs defined in ipset "admin_hosts" on port 22 ansible.builtin.iptables : chain : INPUT match_set : admin_hosts match_set_flags : src destination_port : 22 jump : ALLOW - name : Tag all outbound tcp packets with DSCP mark 8 ansible.builtin.iptables : chain : OUTPUT jump : DSCP table : mangle set_dscp_mark : 8 protocol : tcp - name : Tag all outbound tcp packets with DSCP DiffServ class CS1 ansible.builtin.iptables : chain : OUTPUT jump : DSCP table : mangle set_dscp_mark_class : CS1 protocol : tcp # Create the user-defined chain ALLOWLIST - iptables : chain : ALLOWLIST chain_management : true # Delete the user-defined chain ALLOWLIST - iptables : chain : ALLOWLIST chain_management : true state : absent - name : Insert a rule on line 5 ansible.builtin.iptables : chain : INPUT protocol : tcp destination_port : 8080 jump : ACCEPT action : insert rule_num : 5 # Think twice before running following task as this may lock target system - name : Set the policy for the INPUT chain to DROP ansible.builtin.iptables : chain : INPUT policy : DROP - name : Reject tcp with tcp-reset ansible.builtin.iptables : chain : INPUT protocol : tcp reject_with : tcp-reset ip_version : ipv4 - name : Set tcp flags ansible.builtin.iptables : chain : OUTPUT jump : DROP protocol : tcp tcp_flags : flags : ALL flags_set : - ACK - RST - SYN - FIN - name : Iptables flush filter ansible.builtin.iptables : chain : " {{ item }} " flush : yes with_items : [ 'INPUT' , 'FORWARD' , 'OUTPUT' ] - name : Iptables flush nat ansible.builtin.iptables : table : nat chain : ' {{ item }} ' flush : yes with_items : [ 'INPUT' , 'OUTPUT' , 'PREROUTING' , 'POSTROUTING' ] - name : Log packets arriving into an user-defined chain ansible.builtin.iptables : chain : LOGGING action : append state : present limit : 2/second limit_burst : 20 log_prefix : "IPTABLES:INFO: " log_level : info - name : Allow connections on multiple ports ansible.builtin.iptables : chain : INPUT protocol : tcp destination_ports : - "80" - "443" - "8081:8083" jump : ACCEPTAuthors
Collection links
Issue Tracker Repository (Sources) Communication
-
Ansible.Builtin
推荐文章
|
|
踢足球的鸭蛋 · Unable to reuse ssh connections in Ansible despite PIPELINING = True - Ansible Project - Ansible 3 月前 |
|
|
发怒的莲藕 · 使用变量 — Ansible 社区文档 1 月前 |
|
|
刀枪不入的感冒药 · when条件判断 | 编程技术分享 1 月前 |
|
|
直爽的凉面 · Servlet开发 - 廖雪峰的官方网站 1 年前 |
|
|
文武双全的单车 · 无法从安卓设备连接到mysql 2 年前 |