firewalld

Manages one item — a service, a port, or a rich rule — in a firewalld zone via firewall-cmd --permanent, reloading so the change takes effect. Idempotent: re-applying an unchanged declaration reports no change.

Category: Firewall (base)

States

State	Meaning
`present`	The declared service, port, or rich rule is enabled on the zone; added if missing.
`absent`	The declared service, port, or rich rule is not enabled on the zone; removed if present.

Parameters

Parameter	Type	Description
`zone`	string	Target firewalld zone. The zone must already exist — this module does not create zones. Default: `public`.
`service`	string	A firewalld service name (e.g. `ssh`). Exactly one of `service` / `port` / `rich_rule` is required.
`port`	string	A port or port range with protocol, `PORT[-PORT]/{tcp,udp,sctp,dccp}` (e.g. `8080/tcp`). Exactly one of `service` / `port` / `rich_rule` is required.
`rich_rule`	string	A firewalld rich rule, compared by canonical form. Exactly one of `service` / `port` / `rich_rule` is required.
`reload`	bool	Run `firewall-cmd --reload` after a change to push the permanent change to the running firewalld. Default: `true`.

Examples

Allow the ssh service on the public zone

firewalld:
  allow-ssh:
    state: present
    service: ssh

Open a port on a specific zone

firewalld:
  app-port:
    state: present
    zone: trusted
    port: 8080/tcp

Add a rich rule, and remove a service

Rich rules are matched by canonical form, so reformatting them does not cause drift.

firewalld:
  drop-rfc1918:
    state: present
    rich_rule: rule family="ipv4" source address="10.0.0.0/8" drop
  no-cockpit:
    state: absent
    service: cockpit

Notes

Linux only: operates by shelling out to firewall-cmd; other operating systems return an unsupported-OS error.
Always operates on the permanent configuration; reload: true (the default) makes the change active in the running firewalld.
Exactly one of service / port / rich_rule must be set per declaration.
Rich-rule matching is syntactic only — it does not normalise value semantics (e.g. it will not lowercase a MAC or canonicalise a CIDR), so write such values exactly as firewalld stores them.
Out of scope (planned, #19): whole-zone management and zone creation, interface/source binding, default-zone and per-zone target, masquerade/forward-port/ICMP toggles, --direct rules, ipset, runtime-only changes, and lockdown/panic mode.

firewall iptables