firewall

Manages a single inbound allow rule for a named service or a port, dispatched to whichever firewall backend (iptables, nftables, or firewalld) is in use on the host. Idempotent: re-applying an unchanged declaration reports no change.

Category: Firewall (base)

States

State	Meaning
`present`	The inbound allow rule for the declared service/port exists on the active backend.
`absent`	The inbound allow rule for the declared service/port is removed.

Parameters

Parameter	Type	Description
`service`	string	Catalog service name (e.g. `ssh`, `https`, `samba`) resolved to its port set. Mutually exclusive with `port`; exactly one of the two is required.
`port`	string	Explicit port spec `PORT[-PORT]/{tcp,udp,sctp,dccp}` (e.g. `8080/tcp`, `1000-2000/udp`). Mutually exclusive with `service`; exactly one of the two is required.
`backend`	string	Force a backend — one of `iptables`, `nftables`, `firewalld`. Auto-detected from the host when omitted.
`zone`	string	firewalld zone (firewalld backend only). Default: `public`.
`strict_catalog`	bool	When false, a `service:` name not in the static catalog falls back to the host’s `/etc/services`. Default: `true`.

Examples

Allow SSH inbound

Backend is auto-detected; the SSH service resolves to 22/tcp.

firewall:
  allow-ssh:
    state: present
    service: ssh

Allow an explicit port on a pinned backend

firewall:
  allow-app:
    state: present
    port: 8080/tcp
    backend: nftables

firewalld zone and removal

firewall:
  allow-https-dmz:
    state: present
    service: https
    backend: firewalld
    zone: dmz
  drop-old-port:
    state: absent
    port: 9000/tcp

Notes

Backends: iptables, nftables, and firewalld. Backend is selected by backend: or auto-detected (firewalld → iptables → nftables).
The iptables backend applies dual-stack (IPv4 + IPv6) by default; on a host without ip6tables the IPv6 half is skipped gracefully and the result says so.
Exactly one of service and port must be set.
v0.1 out of scope (planned, #20): action: deny (allow-only today), chain/table/family overrides on the iptables/nftables backends, per-source filtering, and nftables backend chain creation. Use a backend module directly for those.

vlan firewalld