Ansible modules for managing pfSense firewalls
This is a set of modules to allow you to configure pfSense firewalls with ansible.
Ansible Galaxy (as of version 2.9) now has an option for collections. A collection is a distribution format for delivering all type of Ansible content (not just roles as it was before). We have renamed the collection 'pfsensible.core' for galaxy distribution. To install:
ansible-galaxy collection install pfsensible.core
Optionally, you can specify the path of the collection installation with the
-poption.
ansible-galaxy collection install pfsensible.core -p ./collections
Additionally, you can set the
collections_pathsoption in your
ansible.cfgfile to automatically designate install locations.
# ansible.cfg [defaults] collections_paths=collections
With pfsensible.core 0.4.0 we have stopped stripping the pfsense_ prefix from the module names. This caused conflicts with other modules (like the ansible core 'setup' module). You can use the 'collections' keyword in your playbooks and roles to simplify the module names instead.
Just checkout the repository and run your playbooks from the ansible-pfsense directory.
Current ansible (2.9) python discovery should detect the installed python. If not, you can set in your playbook or hosts vars:
pfSense >= 2.4.5:
ansible_python_interpreter: /usr/local/bin/python3.7pfSense < 2.4.5:
ansible_python_interpreter: /usr/local/bin/python2.7
Modules must run as root in order to make changes to the system. By default pfSense does not have sudo capability so
becomewill not work. You can install it with:
- name: "Install packages" package: name: - pfSense-pkg-sudo state: presentand then configure sudo so that your user has permission to use sudo.
The following modules are currently available:
These modules allow you to make important changes at once and, using the purge parameters, to keep the targets configuration strictly synchronized with your playbooks:
These modules allow you to manage installed packages:
Modules in the collection work by editing
/cf/conf/config.xmlusing xml.etree.ElementTree, then calling the appropriate php update function via the pfsense php developer shell.
Some formatting is lost, and CDATA items are converted to normal entries, but so far no problems with that have been noted.
GPLv3.0 or later