Documentation

PLEASE NOTE: This document applies to latest version and not to the latest stable release v2.21

Documentation for other releases can be found by using the version selector in the top right of any doc page.

iptables

Manage iptables firewall rules.

Attributes

check_mode:
  support: full

Parameters

Parameter	Required	Type	Values	Description
chain	true	string		The iptables chain to modify.
table		string		The iptables table to modify. [default: `"filter"`]
state		string	present absent	Whether the rule should be present or absent. [default: `"present"`]
policy		string		Set the policy for the chain (ACCEPT, DROP, REJECT, etc.).
protocol		string		The protocol of the rule (tcp, udp, icmp, all).
source		string		The source address/network.
destination		string		The destination address/network.
source_port		string		The source port.
destination_port		string		The destination port.
jump		string		The jump target (ACCEPT, DROP, REJECT, LOG, etc.).
to_destination		string		The target for DNAT/SNAT (e.g., “192.168.1.1:80”).
to_source		string		The source for SNAT (e.g., “192.168.1.1”).
to_ports		string		The ports for DNAT/SNAT (e.g., “8080-8090”).
in_interface		string		The input interface.
out_interface		string		The output interface.
ctstate		string		Connection tracking states (ESTABLISHED, RELATED, NEW, INVALID).
match		string		Match extensions (state, conntrack, etc.).
rule_num		string		Append rule as a specific rule number (1-based).
flush		boolean		Flush all rules in the chain. [default: `false`]
comment		string		Comment for the rule (requires iptables comment module).
ip_version		string	ipv4 ipv6	The iptables command to use (iptables, ip6tables). [default: `"iptables"`]
flush_all		boolean		Perform a flush before adding rules. [default: `false`]

Examples

- name: Allow HTTP traffic
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: "80"
    jump: ACCEPT

- name: Allow established connections
  iptables:
    chain: INPUT
    ctstate: ESTABLISHED,RELATED
    jump: ACCEPT

- name: Allow traffic from specific source
  iptables:
    chain: INPUT
    source: "192.168.1.0/24"
    jump: ACCEPT

- name: NAT masquerade for outgoing traffic
  iptables:
    table: nat
    chain: POSTROUTING
    source: "10.0.0.0/24"
    out_interface: eth0
    jump: MASQUERADE

- name: Forward port 8080 to 80
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: eth0
    protocol: tcp
    destination_port: "8080"
    jump: DNAT
    to_destination: "127.0.0.1:80"

- name: Remove a specific rule
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: "8080"
    jump: ACCEPT
    state: absent

- name: Set the policy for the INPUT chain
  iptables:
    chain: INPUT
    policy: DROP

- name: Flush all rules in INPUT chain
  iptables:
    chain: INPUT
    flush: true