2019-04-20 Ansible CentOS firewalld 剧本

CentOS使用ansible初始化防火墙
CentOS默认防火墙没有激活，考虑到dmz zone默认ssh和icmp，因此初始化将dmz设为默认区域
这里的剧本里要ansible做的事列举如下：
1、enable firewalld防火墙
2、设定默认区域dmz，绑定网卡eth0
3、允许http/https和ntp/snmp
4、重启防火墙
剧本如下：

---
- hosts: axtestcentos
  become_user: root
  become: true
  tasks:

# Notes:
# Use "dmz" zone and add ssh/http/https/ntp/snmp as example.
# Make dmz the default policy.

    - name: Enable firewalld
      service: name=firewalld state=started enabled=yes

    - name: Set dmz as default policy
      command: firewall-cmd --set-default-zone=dmz

    - name: Add eth0 to dmz zone
      command: firewall-cmd --zone=dmz --add-interface=eth0

    - name: Allow http/https
      command: firewall-cmd --zone=dmz --permanent --add-service=http --add-service=https

    - name: Allow NTP/SNMP
      command: firewall-cmd --zone=dmz --permanent --add-service=ntp --add-service=snmp

    - name: Bounce firewalld
      service: name=firewalld state=restarted

这里使用的是command模块，具体命令可参考2019-03-29 CentOS防火墙firewalld使用
如果使用firewalld模块，可以参考ansbile帮助手册的范例yaml格式

- firewalld:
    service: https
    permanent: true
    state: enabled

- firewalld:
    port: 8081/tcp
    permanent: true
    state: disabled

- firewalld:
    port: 161-162/udp
    permanent: true
    state: enabled

- firewalld:
    zone: dmz
    service: http
    permanent: true
    state: enabled

- firewalld:
    rich_rule: 'rule service name="ftp" audit limit value="1/m" accept'
    permanent: true
    state: enabled

- firewalld:
    source: 192.0.2.0/24
    zone: internal
    state: enabled

- firewalld:
    zone: trusted
    interface: eth2
    permanent: true
    state: enabled

- firewalld:
    masquerade: yes
    state: enabled
    permanent: true
    zone: dmz