- service:
    name: firewalld
    state: started
    enabled: yes
  become: yes

- firewalld:
    service: https
    permanent: true
    state: enabled
  become: yes
  notify: restart firewalld

- firewalld:
    service: http
    permanent: true
    state: enabled
  become: yes
  notify: restart firewalld

- firewalld:
    rich_rule: 'rule service name="ssh" family="ipv4" source address="{{ item }}" accept'
    permanent: true
    state: enabled
  with_items:
    - 128.192.75.0/24
    - 192.168.0.0/16
    - 172.16.0.0/16
    - 128.91.49.0/24
  become: yes
  notify: restart firewalld
  when: is_production_vm == True

- firewalld:
    service: ssh
    permanent: true
    state: disabled
  become: yes
  notify: restart firewalld
  when: is_production_vm == True

- name: define new icmp types for timestamp responses
  copy:
    dest: '/etc/firewalld/icmptypes/{{ item }}.xml'
    src: '{{ item }}.xml'
  become: yes
  with_items:
    - timestamp-reply
    - timestamp-request

- name: load new icmp types for timestamp responses
  command: firewall-cmd --reload
  become: yes

- name: disable icmp timestamp responses
  command: firewall-cmd --permanent --zone=public --add-icmp-block={{ item }}
  become: yes
  with_items:
    - timestamp-reply
    - timestamp-request
  notify: restart firewalld

- name: restart firewalld
  service:
    name: firewalld
    state: restarted
  become: yes