Firewall Configuration

The configure_firewall task delegates to the firewalld role, which manages firewalld zones via fully declarative XML files. Only zones defined in the variable exist on the host — zones removed from the variable are deleted on the next run.

Zone design

Zones are defined in perimeter_auth_firewall_zones, a map where each key becomes a firewalld zone name. The default configures two zones:

Zone	Sources	Allowed traffic	Purpose
public	all (default zone)	HTTPS (443), SSH (22), 7327	Main traffic; target: DROP drops everything else
monitoring	none until set in host_vars	SSH (22), 9113 (nginx exporter), 9100 (node_exporter)	Restricts Prometheus scrapes to specific source CIDRs; SSH must also be listed here for the monitoring host to reach the server

public is the OS default zone — no zone-switching is needed. Traffic from source CIDRs bound to a named zone (like monitoring) is routed exclusively to that zone — it does not fall through to public. Traffic from all other sources uses the public zone.

Default configuration

perimeter_auth_firewall_zones:
  public:
    target: DROP
    services:
      - https
      - ssh
    ports:
      - "7327"
  monitoring:
    sources: []
    ports:
      - "{{ perimeter_auth_prometheus_exporter_port }}"

Port 7327 is a literal, not a variable: it is fixed by Epic's Perimeter Authentication URL table and the role has no setting for it. If you override perimeter_auth_firewall_zones, 7327 must still appear in whichever zone the Hyperdrive traffic arrives from.

With sources: [], the monitoring zone exists on disk but has no source bindings, so no traffic reaches it. The exporter is reachable on localhost regardless of firewall configuration.

Opening the monitoring ports to Prometheus

Add source CIDRs and include both exporter ports in host_vars. Port 9100 is required if node_exporter is also installed via deploy-node_exporter.yml:

# host_vars/epic-pauth-sapph.sapphire.dev.yml
perimeter_auth_firewall_zones:
  public:
    target: DROP
    services:
      - https
      - ssh
    ports:
      - "7327"
  monitoring:
    target: DROP
    sources:
      - 10.248.5.0/24
    services:
      - ssh
    ports:
      - "9113"   # nginx-prometheus-exporter
      - "9100"   # node_exporter

Important: configure_firewall replaces all zone files declaratively. If node_exporter is installed separately via deploy-node_exporter.yml (which opens port 9100 using ansible.posix.firewalld), any subsequent configure_firewall run will overwrite that rule unless port 9100 is included in perimeter_auth_firewall_zones.

See Variables — Alternative configurations for additional zone layouts including load-balancer-restricted and monitoring-disabled variants.

Verifying firewall state

# Show which zones are active (have an interface or source binding)
firewall-cmd --get-active-zones

# List configuration for a specific zone
firewall-cmd --zone=public --list-all
firewall-cmd --zone=monitoring --list-all

# Show all zones with any configuration
firewall-cmd --list-all-zones

Further reading

See the firewalld role documentation for full details on zone management, the automatic revert safety mechanism, and how to add additional zones.