So friends before we actually finished this skill, what I want to do is to
actually address
the subject of configuring our firewall utilizing Ansible Recall and the
earlier videos, we
actually disabled the firewall.
Because quite simply what it was doing, it was blocking access to our HTTP
server.
So let's see how we can go and actually modify this there, okay?
So what I want to do is I want to go to my browser and if you search for Ans
ible Firewall
D, let's click this top link here.
Now we can see here this module is part of the Ansible Politics Collection, but WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we can see here this module is part of the Ansible Politics Collection, but
if you
don't have this collection installed in user command Ansible Galaxy Collection
Install Ansible
Dot Politics, and then you can access this module.
Now it says here in the synopsis, this module is going to allow for the
addition or deletion
of services and ports.
So pretty much if you want to allow or disallow a service such as SSH, you can
specify the
service itself, or if you wish, you can target a particular port, you can say
listen, I want
to close off port 1, 2, 3 on TCP or conversely open up port whatever it may be. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to close off port 1, 2, 3 on TCP or conversely open up port whatever it may be.
So let's scroll on right down here, check out this option here in Mediate.
This is going to be a billion value, now by default it's set to false.
If we set it to true though, what it means is that the configuration that you
're setting
is going to be applied immediately if the configuration has been set as
permanent.
So let's go and look at this permanent status, scrolling on down, we can see
here permanent
as a parameter that again takes a billion value, and pretty much what it's
saying here is that
should this configuration be ended running firewall deconfiguration or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
should this configuration be ended running firewall deconfiguration or
processed across
reboots, basically do you want the change that you just made to be temporary,
and when
you reboot the system it's going to flush out that firewall rule, or
alternatively you
can have it processed with permanence, this is all we're talking about here.
Now if you want to specify a particular port or a particular range of ports to
maybe remove
or add from your firewall you can use the port option, whereas scrolling on
down if you
just want to specify a particular service then you can just use the service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
just want to specify a particular service then you can just use the service
keyword which
is going to take a string value.
Now it actually gives us a little bit of a tip if you're curious about the type
of services
that you can specify and supply as a value to the service parameter, you can
run the
command firewall cmd get services, if that service is listed in this output you
can use
it as a valid value here.
Now this is a very important one if you scroll on down, this is the state
parameter, this
one here is required so we're going to have to specify this when we use the
module if
we want the module to operate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we want the module to operate.
So basically what we're talking about here is should the service or the port be
accepted
or denied or in the terminology here enabled or disabled.
So how about we go and take this information and we shall apply it to a
playbook.
Now first thing is first I want to ensure that my firewall is running so I'll
say pseudo
systemctl start firewall D and again do the same thing on the blue box.
Okay so if we check the status of our firewall indeed we can see this as active
and running
in the same thing is true on the yellow box perfect. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the same thing is true on the yellow box perfect.
So let's open up Firefox on my control modes.
If I try to access my web server and hit enter notice because the firewall is
now re-enabled
it pretty much is blocking the connection.
So let's create a new playbook called play four dot yml, let's give this
playbook a name
what I say play four and we'll just say manage firewall.
Here we're going to target we're going to target the all groups of both hosts
and the
network gather facts is going to be set to false and then let's define our task
.
So let's give this task your name and we'll just say allow web traffic through WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's give this task your name and we'll just say allow web traffic through
firewall.
So the module will be answerable POSIX firewall D and now specify the service
that I want
to enable.
Now what I'm going to do here is I'm going to just enable traffic for HTTP and
HTTPS.
Right now my web server is only serving traffic over port 80 that is regular on
encrypted HTTP
but nevertheless because that's a more realistic configuration let me just
demonstrate it.
So what I will do here is I will have my quotation marks and then my double
curly braces and
then I will use the keyword item. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
then I will use the keyword item.
This is going to act as my placeholder and then I'm going to specify permanence
will
be the billion value of true and I will specify immediate but also the billion
value of true
so we're going to have the configuration be immediately activated and persist
and state
is going to be enabled.
Pretty much we're going to enable this particular service IE allow it.
Now this here is going to be what I'm looping through.
So what I want to do here is use my loop keyword and then I want to specify my
values. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
values.
So right now I'm going to call a variable and the variable is just going to be
rules.
Right now as it stands I haven't actually defined those rules so what I could
do is I could just
specify my vars and I specify my rules here and the rules is going to be HTTP
and HTTPS.
So pretty much I'm going to take this iterable object, loop through it and upon
first iteration
we'll specify the service as HTTP, permanent true, immediate true and enable it
then loop to the next
configuration, HTTPS and then have the same configurations applied, permanent, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
configuration, HTTPS and then have the same configurations applied, permanent,
immediate and
enabled.
So let's just say this right here and if I just say Ansible Playbook play 4.YML
and to enter,
give it a moment, now we see a change.
So if I say Ansible all and then -a and I run the command firewall CMD dash
dash list services
and I run this command against both my devices and to enter, look at what we
actually seen the
output, look at the yellow box right here, CB actually have HTTP and HTTPS now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
output, look at the yellow box right here, CB actually have HTTP and HTTPS now
allowed
in similarly on the blue box, the same thing is true, we're now allowing HTTP
and HTTPS.
So what that now means is if I go back to my browser right here on my control
nodes,
come back into Firefox, once again back on my control node, if I now try the
website,
as we can see here we can access the blue box and if I change this to 135 and
enter,
now we actually get the access to the yellow box server.
So that's how we can modify our firewall rows using Ansible, let's now validate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's how we can modify our firewall rows using Ansible, let's now validate
what we've learned
within this skill.