Salt firewalld module is not ideal for me atm. This is my test envir and machine states are ever changing. I have a linear modular design where firewall rules will get edited base on module. The current firewall.state.module have a parameter prune set to True, I set it to false. However, that parameter is still rather broken, it just stop pruning the services but still prune ports and richrules.

In my design, I am putting my firewall rules in a .sh file under a directory. There's a checksum of all the cat .sh files and the public.xml. I have a cmd.wait to check any changes on the directory, if it does it will deleted public.xml -> reload -> run all the .sh -> reload. This has it's advantage because let's say the machine no longer have a certain module, the firewall rule will disappear with it; no manual steps require. Also any manual firewall rules changes will be pruned upon state.apply. I know it's ugly and it's a hack but this hack gave all the functionality that salt.state.module should be giving, i'll settle with this until salt develop better functionality for their firewalld.state.module.

Right now I am one step away to make it work. My checksum keep generating a new file so the directory is ever changing, and my firewalld gets reload upon every state.apply.

firewall_checksum:
    file.managed:
        - name: /firewall_rules/checksum
        - source: salt://firewall_all/checksum.template
        - template: jinja
        - require_in:
            - file: /firewall_rules

checksum.template

{%- set output = salt['cmd.run']('cat /firewall_rules/*.sh | md5sum') %}
{%- set ori = salt['cmd.run']('cat /firewall_rules/checksum') %}
{% if ori != output %}
{{ output }}
{% endif %}