RHEL7 / CentOS7 disable firewalld

[gerhard-tinned]

In the currenmt version of this role, iptables is installed, enabled and started. In RHEL7 and CentOS7, the alternative firewall daemon "firewalld" is used by default. This daemon has to be stopped and most important disabled.

I therefore added the following task to the "persist-redhat.yml" file. This task would be best to be executed right before iptables service is started.

- name: Ensure firewalld service is disabled and stopped
  systemd:
    name: firewalld
    state: stopped
    enabled: no
    masked: yes
  register: firewalld_result
  failed_when: "firewalld_result is failed and 'Could not find the requested service' not in firewalld_result.msg"
  when: ansible_os_family == 'RedHat' and ansible_distribution_major_version >= '7'

This task ensures that the firewalld is not only stopped but also disabled and masked. Masking avoids accidental start ofg this service even manually. The when should prevent the role from failing if the firewalld service is not installed on the system.

I have seen that you prefere the one-line version of the tasks, I hope this is still helpful for you. I have tested this on CentOS 7.5 and it should workj without modification as well on RHEL 7.5.

If you prefere a pull request, please let me know.

[mikegleasonjr]

Thank you very much for the contribution! Will have a look at it this week.

[wojciech-kopras]

On my servers I deal with this problem by uninstalling firewalld - I cannot find any reason to have installed firewalld when I use iptables-services and this ansible role.

- name: remove firewalld
  package:
    name: firewalld
    state: absent

[mikegleasonjr]

Thanks for the reminder guys!