iptables - Modify the systems iptables

• Synopsis
• Parameters
• Notes
• Examples
• Status
  • Support
  • Author

Synopsis

• Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel.
• This module does not handle the saving and/or loading of rules, but rather only manipulates the current rules that are present in memory. This is the same as the behaviour of the iptables and ip6tables command which this module uses internally.

Parameters

Notes

Examples

# Block specific IP
- iptables:
    chain: INPUT
    source: 8.8.8.8
    jump: DROP
  become: yes

# Forward port 80 to 8600
- iptables:
    table: nat
    chain: PREROUTING
    in_interface: eth0
    protocol: tcp
    match: tcp
    destination_port: 80
    jump: REDIRECT
    to_ports: 8600
    comment: Redirect web traffic to port 8600
  become: yes

# Allow related and established connections
- iptables:
    chain: INPUT
    ctstate: ESTABLISHED,RELATED
    jump: ACCEPT
  become: yes

# Allow new incoming SYN packets on TCP port 22 (SSH).
- iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 22
    ctstate: NEW
    syn: match
    jump: ACCEPT
    comment: Accept new SSH connections.

# Tag all outbound tcp packets with DSCP mark 8
- iptables:
    chain: OUTPUT
    jump: DSCP
    table: mangle
    set_dscp_mark: 8
    protocol: tcp

# Tag all outbound tcp packets with DSCP DiffServ class CS1
- iptables:
    chain: OUTPUT
    jump: DSCP
    table: mangle
    set_dscp_mark_class: CS1
    protocol: tcp

# Insert a rule on line 5
- iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 8080
    jump: ACCEPT
    rule_num: 5

# Set the policy for the INPUT chain to DROP
- iptables:
    chain: INPUT
    policy: DROP

# Reject tcp with tcp-reset
- iptables:
    chain: INPUT
    protocol: tcp
    reject_with: tcp-reset
    ip_version: ipv4

# Set tcp flags
- iptables:
    chain: OUTPUT
    jump: DROP
    protocol: tcp
    tcp_flags:
      flags: ALL
      flags_set:
        - ACK
        - RST
        - SYN
        - FIN

Status

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Support

For more information about Red Hat’s support of this module, please refer to this Knowledge Base article

Author

• Linus Unnebäck (@LinusU) <linus@folkdatorn.se>
• Sébastien DA ROCHA (@sebastiendarocha)