How to properly define ip6tables rule in ansible

Asked Jun 21 '22 at 07:47

Active Jun 21 '22 at 11:36

Viewed 58 times

On current system I have this rule for ip6tables

-A INPUT -d <ip6address> -p udp -m udp --dport <port> -m state --state NEW -j ACCEPT

For new system I wrote an ansible playbook:

- name: Allow someport for ipv6
  ansible.builtin.iptables:
    chain: INPUT
    protocol: udp
    match: udp
    ip_version: ipv6
    ctstate: NEW
    destination_port: 'port'
    destination: 'ip6address'
    jump: ACCEPT
  tags:
    - iptables6

But when I try to play this I get an error:

{... "stderr_lines": ["ip6tables v1.8.7 (nf_tables): unknown option \"--destination-port\"", "Try `ip6tables -h' or 'ip6tables --help' for more information."], "stdout": "", "stdout_lines": []}

Ansible 2.10.8
Debian 11

How to properly define this rule?

edited Jun 21 '22 at 11:36

asked Jun 21 '22 at 07:47

GarfieldCat

2

Do you have {"become": "yes", "become_user": "root"} in your play? – Christopher Causer Jun 21 '22 at 08:56
@ChristopherCauser I think your question is irrelevant to the problem occured. ip6tables will either have the required command line option or not have it, no matter how the play looks. By the way, become better be configured in ansible configuration or in the inventory, the play is least attractive place to do it. – Nikita Kipriyanov Jun 21 '22 at 09:20
2

@NikitaKipriyanov that's just not true: https://serverfault.com/a/1050048/242077 – Christopher Causer Jun 21 '22 at 09:37
Well. You're right. I never run iptables as non root. But the error message is misleading. – Nikita Kipriyanov Jun 21 '22 at 09:47
Agreed. The error message is just horrible! – Christopher Causer Jun 21 '22 at 10:09

How to properly define ip6tables rule in ansible

0 Answers0