{"id":29357031,"url":"https://github.com/cesnet/ansible-role-firewall","last_synced_at":"2026-02-14T08:02:43.529Z","repository":{"id":51691116,"uuid":"206827145","full_name":"CESNET/ansible-role-firewall","owner":"CESNET","description":"Ansible Galaxy role cesnet.firewall","archived":false,"fork":false,"pushed_at":"2025-09-12T10:39:25.000Z","size":39,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-10-07T09:51:31.149Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jinja","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CESNET.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2019-09-06T15:49:11.000Z","updated_at":"2025-09-12T09:50:13.000Z","dependencies_parsed_at":"2024-03-22T11:52:14.386Z","dependency_job_id":null,"html_url":"https://github.com/CESNET/ansible-role-firewall","commit_stats":null,"previous_names":[],"tags_count":21,"template":false,"template_full_name":null,"purl":"pkg:github/CESNET/ansible-role-firewall","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CESNET%2Fansible-role-firewall","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CESNET%2Fansible-role-firewall/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CESNET%2Fansible-role-firewall/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CESNET%2Fansible-role-firewall/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CESNET","download_url":"https://codeload.github.com/CESNET/ansible-role-firewall/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CESNET%2Fansible-role-firewall/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29439821,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-14T07:24:13.446Z","status":"ssl_error","status_checked_at":"2026-02-14T07:23:58.969Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-07-09T05:41:29.433Z","updated_at":"2026-02-14T08:02:43.506Z","avatar_url":"https://github.com/CESNET.png","language":"Jinja","funding_links":[],"categories":[],"sub_categories":[],"readme":"cesnet.firewall\n======================\n\nAnsible Galaxy role [cesnet.firewall](https://galaxy.ansible.com/cesnet/firewall) \nthat installs iptables firewall on Debian prepared for rules for Docker.\n\nThe role creates a systemd service named \"iptables\" for applying rules and enables it for reboots.\nApply rules from /etc/iptables with:\n```bash\nsystemctl restart iptables\n```\n\nRole Variables\n--------------\n- firewall_do_install - installs iptables-legacy and selects them as the default iptables alternative\n- firewall_do_config - creates files with rules and applies them\n- firewall_open_ssh_ports - predefined rules for accepting ssh only from networks of MUNI,CESNET,ZCU \n- firewall_open_tcp_ports - empty set, define as in the example below \n- firewall_known_ranges - known ranges for the Czech academic network\n- firewall_docker_rules - empty set, one rule per port can be defined for restricting access to Docker containers\n\nExample Playbook\n----------------\n```yaml\n- hosts: all\n  roles:\n    - role: cesnet.firewall\n      vars:\n        firewall_open_ssh_ports:\n          - { port: \"ssh\", ipv4: \"147.251.0.0/16\", comment: \"accept ssh from MUNI\" }\n          - { port: \"ssh\", ipv4: \"147.228.0.0/16\", comment: \"accept ssh from ZCU\" }\n          - { port: \"ssh\", ipv4: \"147.231.0.0/16\", comment: \"accept ssh from CAS\" }\n          - { port: \"ssh\", ipv4: \"160.217.0.0/16\", comment: \"accept ssh from JCU\" }\n          - { port: \"ssh\", ipv4: \"78.128.208.0/20\", comment: \"accept ssh from CESNET\" }\n          - { port: \"ssh\", ipv4: \"195.113.0.0/16\", comment: \"accept ssh from CESNET\" }\n          - { port: \"ssh\", ipv6: \"2001:718::/32\", comment: \"accept ssh from CESNET provider\" } \n        firewall_open_tcp_ports:\n          - { port: 25, ipv4: \"147.251.0.0/16\", comment: \"accept SMTP from MUNI\" }\n          - { port: 80, comment: \"accept http\" }\n          - { port: 443, comment: \"accept https\" }\n          - { port: 636, comment: \"accept ldaps\" }\n          - { port: 5432, ipv6: \"2001:718::/32\", comment: \"accept postgres from CESNET\" }\n          - { port: 5432, ipv6: \"147.251.0.0/16\", comment: \"accept postgres from MUNI\" }\n          - { port: 9000, ipv6: \"2001:718:801::/48\", comment: \"accept portainer from MUNI\" }\n        firewall_docker_rules:\n          - port: 9000\n            only:\n              - { ipv4: \"147.251.0.0/16\", comment: \"portainer from MUNI\"}\n              - { ipv4: \"78.128.246.160/32\", comment: \"portainer from CESNET eduVPN\" }\n              - { ipv4: \"78.128.247.175/32\", comment: \"portainer from CESNET eduVPN\" }\n          - port: 443\n            only:\n              - { ipv4: \"147.251.0.0/16\", comment: \"https only from MUNI\" }\n```\nFor more complex setups, you can use filters, e.g. to open ports 80 and 443 to known IP ranges only:\n```yaml\n- hosts: all\n  vars:\n    my_ranges:\n      - { ipv4: \"147.251.0.0/16\", comment: \"allow from MUNI\" }\n      - { ipv6: \"2001:718:801::/48\", comment: \"allow from MUNI\" }\n      - { ipv4: \"147.32.0.0/16\", comment: \"allow from CVUT\" }\n      - { ipv4: \"147.228.0.0/16\", comment: \"allow from ZCU\" }\n    firewall_open_tcp_ports: \"{{ (my_ranges|map('combine',{'port':'http'})|list) + (my_ranges|map('combine',{'port':'https'})|list) }}\"\n  roles:\n    - role: cesnet.firewall\n\n```\n\nDocker compatibility\n------\nTCP ports exported from Docker containers are exposed in the FORWARD chain which\nis processed before INPUT chain, so the firewall rules from the INPUT chain do not apply to containers,\nsee [Docker and iptables](https://docs.docker.com/network/iptables/).\n\nYou can put rules into the chain DOCKER-USER for rejecting packets before they reach the chain DOCKER.\n\nDocker manipulates only IPv4 iptables. Ports exported from containers do listen on all IPv6 addresses, so\nrules from the INPUT chain do apply to IPv6 packets. Thus you have to explicitly allow a port exported\nfrom a container to be available over IPv6.\n\nIn short, if you want to restrict access to a port 9000 exported from a container in both IPv4 and IPv6,\ndo it like this:\n```yaml\n    - role: cesnet.firewall\n      vars:\n        firewall_open_tcp_ports:\n          - { port: 9000, ipv6: \"2001:718:801::/48\", comment: \"accept 9000 only from MUNI over IPv6\" }\n          - { port: 9000, ipv6: \"2001:718:1:13::/64\", comment: \"accept 9000 only from CESNET VPN over IPv6\" } \n        firewall_docker_rules:\n          - port: 9000\n            only:\n              - { ipv4: \"147.251.0.0/16\", comment: \"portainer from MUNI\"}\n              - { ipv4: \"78.128.246.160/32\", comment: \"portainer from CESNET eduVPN\" }\n              - { ipv4: \"78.128.247.175/32\", comment: \"portainer from CESNET eduVPN\" }\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcesnet%2Fansible-role-firewall","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcesnet%2Fansible-role-firewall","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcesnet%2Fansible-role-firewall/lists"}