Merge branch 'iptables-persistent'

Author: mikegleasonjr

Vagrantfile

@@ -4,17 +4,23 @@ boxes = {
     :cpu => "2",
     :ram => "256"
   },
-  "centos/7" => {
+  "ubuntu/xenial64" => {
     :ip  => '192.168.33.11',
     :cpu => "2",
     :ram => "256"
   },
+  "centos/7" => {
+    :ip  => '192.168.33.12',
+    :cpu => "2",
+    :ram => "256"
+  },
 }
 
 Vagrant.configure("2") do |config|
   boxes.each do |box, options|
     config.vm.define box.dup.sub!("/", "-") do |machine|
       machine.vm.box = box
+      machine.vm.box_check_update = false
       machine.vm.network :private_network, ip: options[:ip]
 
       machine.vm.provider "virtualbox" do |vb|

tasks/main.yml

@@ -1,5 +1,4 @@
 ---
-- include: vars.yml
 - include: rules.yml
 
 - include: persist-debian.yml

tasks/persist-debian.yml

@@ -1,6 +1,27 @@
 ---
-- name: Copy v4 save script
-  template: src=save.v4.j2 dest=/etc/network/if-post-down.d/iptables-v4 owner=root group=root mode=755
+- name: Remove any obsolete v4 save script
+  file: path=/etc/network/if-post-down.d/iptables-v4 state=absent
 
-- name: Copy v4 restore script
-  template: src=restore.v4.j2 dest=/etc/network/if-pre-up.d/iptables-v4 owner=root group=root mode=755
+- name: Remove any obsolete v4 restore script
+  file: path=/etc/network/if-pre-up.d/iptables-v4 state=absent
+
+- name: Remove any obsolete v4 saved rules
+  file: path=/etc/iptables.v4.saved state=absent
+
+- name: Install iptables-persistent
+  apt: name=iptables-persistent state=present
+
+- name: Check if netfilter-persistent is present
+  shell: which netfilter-persistent
+  register: is_netfilter
+  when: v4_script|changed
+  changed_when: false
+  ignore_errors: yes
+
+- name: Save v4 rules (netfilter-persistent)
+  command: netfilter-persistent save
+  when: v4_script|changed and is_netfilter.rc == 0
+
+- name: Save v4 rules (iptables-persistent)
+  command: /etc/init.d/iptables-persistent save
+  when: v4_script|changed and is_netfilter.rc == 1

tasks/persist-redhat.yml

@@ -1,4 +1,8 @@
 ---
+- name: Save v4 rules (/etc/sysconfig/iptables)
+  shell: iptables-save -c > /etc/sysconfig/iptables
+  when: v4_script|changed
+
 - name: Ensure iptables service is installed
   yum: name=iptables-services state=present
   when: ansible_distribution_major_version >= '7'

tasks/rules.yml

@@ -8,7 +8,3 @@
   register: v4_script_load_result
   failed_when: v4_script_load_result.rc != 0 or 'unknown option' in v4_script_load_result.stderr
   when: v4_script|changed
-
-- name: Save v4 rules
-  shell: iptables-save -c > {{ firewall_v4_saved_rules_path }}
-  when: v4_script|changed

tasks/vars.yml

@@ -1,6 +1,6 @@
 ---
 - hosts: all
-  sudo: true
+  become: true
 
   roles:
     - role: .