Using Ansible Firewall Rules

1. Sign in to the server called Ansible Control Node using the cloud_user, and then change to the ansible user via the su - ansible command.

2. Test that Ansible is working via an ad-hoc command. We can use the following:

   ansible all -m ping
   

1. Check that firewalld is not installed on the nodes:

ssh node1
sudo systemctl status firewalld

1. Use exit to move onto the next node check:

ssh node2
sudo systemctl status firewalld

1. Create the playbook:

vim setup-server.yml

1. The playbook file could appear like so for the installations, plus enabling and starting the Apache Web Server:

---
- hosts: all
  user: ansible
  become: yes
  gather_facts: no
  tasks:
    - name: install elinks
      action: yum name=elinks state=installed
    - name: install httpd
      action: yum name=httpd state=installed
    - name: Enable Apache on system reboot
      service: name=httpd enabled=yes
    - name: Start service httpd, if not started
      service:
        name: httpd
        state: started

1. Using the elinks command. We will verify that we can see the Apache HTTP Server test page on the 2 Ansible nodes with the following commands:

elinks http://node1
elinks http://node2

1. Make changes to the playbook for installing firewalld:

---
- hosts: all
  user: ansible
  become: yes
  gather_facts: no
  tasks:
    - name: install elinks
      action: yum name=elinks state=installed
    - name: install httpd
      action: yum name=httpd state=installed
    - name: Enable Apache on system reboot
      service: name=httpd enabled=yes
    - name: Start service httpd, if not started
      service:
        name: httpd
        state: started
    - name: install firewalld
      action: yum name=firewalld state=installed
    - name: Enable firewalld on system reboot
      service: name=firewalld enabled=yes
    - name: Start service firewalld, if not started
      service:
        name: firewalld
        state: started

1. Save and exit.
2. Run the playbook with the changes applied:

vim setup-server.yml
ansible-playbook setup-server.yml

1. Verify that we are unable to access the test pages on node1 and node2 with the following commands:

elinks http://node1
elinks http://node2

Note: We will be unable to access the test pages because the firewall will be blocking them.

1. Make changes to the playbook for installing firewalld:

---
- hosts: all
  user: ansible
  become: yes
  gather_facts: no
  tasks:
    - name: install elinks
      action: yum name=elinks state=installed
    - name: install httpd
      action: yum name=httpd state=installed
    - name: Enable Apache on system reboot
      service: name=httpd enabled=yes
    - name: Start service httpd, if not started
      service:
        name: httpd
        state: started
    - name: install firewalld
      action: yum name=firewalld state=installed
    - name: Enable firewalld on system reboot
      service: name=firewalld enabled=yes
    - firewalld:
        service: http
          permanent: yes
          state: enabled
      - name: Restart service firewalld
        service:
        name: firewalld
        state: restarted

1. Save and exit.
2. Run the playbook with the changes applied:

vim setup-server.yml
ansible-playbook setup-server.yml

1. Verify that we are unable to access the test pages on node1 and node2 with the following commands:

elinks http://node1
elinks http://node2

Note: We will be unable to access the test pages because the firewall will be blocking them.

1. Run the playbook:

vim setup-server.yml
ansible-playbook setup-server.yml

1. Using the elinks command again:

 elinks http://node1
 elinks http://node2