rich_rules and port ranges

[tuxpeople]

Hi

Thanks a lot for those incredible roles!

I using this role for the deployment of a Kubernetes cluster. While doing this, I found two things which I think are currently not possible with your role.

1.) I wanted to configure Firewalld to open the whole range of standard nodeports, which is 30000-32767/tcp. I was able to do so with a Ubuntu, defining 30000:32767 as the name and tcp as protocol. The colon is important (its UFW syntax). Doing the same with Centos8 was not possible. Because a) in Firewalld a range has a dash, not a colon (eg 30000-32767). But this change didn't help as b) the role opens services and not ports. And Firewalld needs the range to be port, not service AFAIK.

2.) I also used your keepalived role in this project. As that role doesn't open the Firewall, I wanted to do this with your firewall role. But I didn't found a way. Therefore, my playbooks looks like this:

    - name: Firewall
      import_role:
        name: robertdebock.roles.firewall

    - name: "Open Firewall for vrrp (keepalived)"
      firewalld:
        rich_rule: rule protocol value="vrrp" accept
        permanent: yes
        state: enabled
        immediate: yes

Is there a way this can be done with this role?

[robertdebock]

This is currently not possible; I've kept the role quite simple to allow the role to be used on many distributions...

This is quite a hard one; such a rich_rule is only applicable to firewalld, not ufw.

Either make a suggestion (pull request) or give this some time to address.

Thanks for the feedback!