jimbo8098
commented
4 years ago Just in case anyone else is affected by this, here's the task I used as a workaround:
- name: Open necessary ports
win_shell: |
Import-Module NetSecurity
$prot = "{{ item.protocol }}"
$port = "{{ item.port }}"
[Microsoft.PowerShell.Cmdletization.GeneratedTypes.NetSecurity.Profile] $profile = "{{ item.profile }}"
[Microsoft.PowerShell.Cmdletization.GeneratedTypes.NetSecurity.Direction] $direction = "{{ item.direction }}"
$name = "{{ item.name }}"
[Microsoft.PowerShell.Cmdletization.GeneratedTypes.NetSecurity.Direction] $inbound = "Inbound"
[bool] $found = $false
$portfilters = (Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -eq $port})
foreach($portfilter in $portfilters)
{
$rule = ($portfilter | Get-NetFirewallRule)
if(
$rule.DisplayName -eq $name -And
$rule.Enabled -eq $true -And
$rule.Action -eq "Allow" -And
$rule.Direction.CompareTo($direction) -eq 0 -And
$rule.Profile.CompareTo($profile) -eq 0
)
{
$found = $true
}
}
if(!$found)
{
echo "${direction} ${port}/${prot} ${profile}: Not found, adding!"
New-NetFirewallRule -DisplayName $name -LocalPort $port -Profile $profile -Direction $direction -Protocol $prot
$res = $?
if($res -eq $true)
{
exit 0
}
else
{
exit 2
}
}
else
{
echo "${direction} ${port}/${prot} ${profile}: Found!"
exit 1
}
loop:
- { port: 2376, protocol: "TCP", profile: "Domain", direction: "Inbound", name: "Docker TLS port"}
- { port: 2377, protocol: "TCP", profile: "Domain", direction: "Inbound", name: "Docker cluster management communications"}
- { port: 7946, protocol: "TCP", profile: "Domain", direction: "Inbound", name: "Docker node communications (TCP)" }
- { port: 7946, protocol: "UDP", profile: "Domain", direction: "Inbound", name: "Docker node communications (UDP)" }
- { port: 4789, protocol: "UDP", profile: "Domain", direction: "Inbound", name: "Docker overlay network traffic" }
- { port: 2376, protocol: "TCP", profile: "Domain", direction: "Outbound", name: "Docker TLS port"}
- { port: 2377, protocol: "TCP", profile: "Domain", direction: "Outbound", name: "Docker cluster management communications"}
- { port: 7946, protocol: "TCP", profile: "Domain", direction: "Outbound", name: "Docker node communications (TCP)" }
- { port: 7946, protocol: "UDP", profile: "Domain", direction: "Outbound", name: "Docker node communications (UDP)" }
- { port: 4789, protocol: "UDP", profile: "Domain", direction: "Outbound", name: "Docker overlay network traffic" }
changed_when: firewall_res.rc == 0
failed_when: firewall_res.rc == 2
register: firewall_res
jborean93
I have written an Ansible playbook with the intention of building a docker cluster, however, I am having some issues wherein the win_firewall_rule doesn't result in the inbound rules (specifically) being added. Inbound rules are added perfectly fine. Here is my task list.
These rules should allow access on all profiles on:
Now I've done some digging in /usr/lib/python3/dist-packages/ansible/modules/windows/win_firewall_rule.ps1 on the host and found that the creation depends on
New-Object -ComObject HNetCfg.FWRule. To emulate that I tried to add a new rule manually using the following object, based onNew-Object -ComObject HNetCfg.FWRule:ISSUE TYPE
COMPONENT NAME
win_firewall_rule
ANSIBLE VERSION
CONFIGURATION
OS / ENVIRONMENT
On the server I'm running the script on:
STEPS TO REPRODUCE
Using the following task list, the issue is apparent with all inbound rules.
EXPECTED RESULTS
Get-NetFirewallRule -DisplayName "Docker*"Should show the newly added firewall rule alongside the inbound rules showing in the firewall control panel for Windows.
ACTUAL RESULTS
Windows Defender Firewall and Get-NetFirewallRule do not show the inbound rules.