Add iptables rules and run install check conditionally

handlers/main.yml

@@ -20,3 +20,8 @@
   notify:
         - Enable unbound
         - Set unbound as default dns
+- name: Save netfilter rules
+  command:
+        argv:
+                - '/usr/sbin/netfilter-persitent'
+                - 'save'

tasks/main.yml

@@ -12,3 +12,36 @@
         state: present
         cache_valid_time: 3600
   notify: Disable systemd-resolved
+  when: unbound|bool == true
+- name: Allow Unbound TCP through iptables
+  loop:
+          - ipv4
+          - ipv6
+  iptables:
+          chain: INPUT
+          ctstate:
+                  - NEW
+                  - ESTABLISHED
+                  - RELATED
+          destination_port: "53"
+          jump: ACCEPT
+          ip_version: '{{ item }}'
+          protocol: tcp
+  notify:
+          - Save netfilter rules
+- name: Allow Unbound UDP through iptables
+  loop:
+          - ipv4
+          - ipv6
+  iptables:
+          chain: INPUT
+          ctstate:
+                  - NEW
+                  - ESTABLISHED
+                  - RELATED
+          destination_port: "53"
+          jump: ACCEPT
+          ip_version: '{{ item }}'
+          protocol: udp
+  notify:
+          - Save netfilter rules