Variables

firewalld_zones

Type: map
Default: {}

A map of firewalld zone definitions. Each key becomes the zone name and maps to /etc/firewalld/zones/<name>.xml. Any zone file on the host that is not present as a key in this map is deleted on the next run.

Zone fields

Field	Type	Required	Description
target	string	No	Zone target policy. DROP silently discards unmatched traffic (recommended). REJECT sends an ICMP rejection. ACCEPT allows all unmatched traffic. Omit to use firewalld's default behavior.
services	list of strings	No	Named firewalld services to allow (e.g. ssh, https). Maps to /usr/lib/firewalld/services/<name>.xml definitions.
ports	list of strings	No	TCP port numbers to allow (e.g. "7327", "9113"). All ports are opened as TCP.
sources	list of strings	No	Source CIDRs that bind traffic to this zone (e.g. 10.248.5.0/24). When set, only traffic originating from these addresses is handled by this zone. Omit or leave empty to use the zone as an interface-based (default) zone.

Examples

Single public zone — DROP with explicit allows:

firewalld_zones:
  public:
    target: DROP
    services:
      - https
      - ssh
    ports:
      - "7327"

Public zone plus source-restricted monitoring zone:

firewalld_zones:
  public:
    target: DROP
    services:
      - https
      - ssh
    ports:
      - "7327"
  monitoring:
    target: DROP
    sources:
      - 10.248.5.0/24
    services:
      - ssh
    ports:
      - "9113"   # nginx-prometheus-exporter
      - "9100"   # node_exporter

Load balancer zone — restrict HTTPS and vendor port to LB source IP:

firewalld_zones:
  public:
    target: DROP
    services:
      - ssh
  load_balancer:
    target: DROP
    sources:
      - 10.248.1.10/32
    services:
      - https
    ports:
      - "7327"
  monitoring:
    target: DROP
    sources:
      - 10.248.5.0/24
    ports:
      - "9113"
      - "9100"

Minimal — SSH only (safe default when no other zones are needed yet):

firewalld_zones:
  public:
    target: DROP
    services:
      - ssh