geerlingguy / ansible-role-firewall

Ansible Role - iptables Firewall configuration.
https://galaxy.ansible.com/geerlingguy/firewall/
MIT License
524 stars 217 forks source link

feature request: allow to use --wait [seconds] in firewall.bash #108

Open shk3bq4d opened 5 months ago

shk3bq4d commented 5 months ago

Hello,

Thank you for all the work all those years.

from iptables man page:

       -w, --wait [seconds]
              Wait for the xtables lock.  To prevent multiple instances of the program from running concur‐
              rently,  an attempt will be made to obtain an exclusive lock at launch.  By default, the pro‐
              gram will exit if the lock cannot be obtained.   This  option  will  make  the  program  wait
              (indefinitely or for optional seconds) until the exclusive lock can be obtained.

       -W, --wait-interval microseconds
              Interval  to  wait  per each iteration.  When running latency sensitive applications, waiting
              for the xtables lock for extended durations may not be acceptable. This option will make each
              iteration  take  the  amount of time specified. The default interval is 1 second. This option
              only works with -w.

currently the firewall.bash template silently ignores iptables command that fail for any reason.

One such reason could be a competing iptables command run by another service (docker, wireguard, anything similar). While dependencies between services is none of the concern of this role, allowing to use the --wait [seconds] in each instantiation of the iptables binary may improve the end result of starting service (even though again, such problems should be solved differently).

I'll try to come up with a MR to see if this gathers interest.

github-actions[bot] commented 1 month ago

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

Please read this blog post to see the reasons why I mark issues as stale.