I'm new to Ansible. Here's my task ...

I have 400+ hosts, and I need to verify if 5 different ports are open from their end to our web server.

Individually, I could log in and run:

telnet mywebserver.com 443
telnet mywebserver.com 80
telnet mywebserver.com 8443

..and so on..

What module or plugin could be used in Ansible so I could automate this, and have it report the results (whether open or closed ports) back to my Ansible server?

4 Answers 4


You can use the Ansible wait_for module which checks a specific TCP port is open.

Since in this case, all ports should be open already, we can use a minimal no. of retries, just enough to cover network issues:

- name: Check all port numbers are accessible from the current host
    host: mywebserver.com
    port: "{{ item }}"
    state: started         # Port should be open
    delay: 0               # No wait before first check (sec)
    timeout: 3             # Stop checking after timeout (sec)
  ignore_errors: yes
    - 443
    - 80
    - 80443

By default, Ansible will check once every second (configurable in Ansible 2.3 using the sleep attribute), so this will check 3 times per port.

Run this in a playbook against your inventory of 400+ hosts - Ansible will check in parallel that all hosts can reach mywebserver.com on those ports.

  • the parallelism is subject to the forks setting in your ansible.cfg.

We use ignore_errors: yes here so that any errors are marked in red but do not stop execution.

Open ports are reported as ok items in output and closed ports are reported as failed (you must use -vv flag on ansible-playbook to see this output).

Fine-tuning output

If you want more specific output for the success and failure cases, the code must be more complex, adding a second task:

  • wait_for task must register a variable
  • the second task produces output using debug based on success/failure condition (e.g. using Jinja2 conditional expression)
  • then you need to put both these tasks in an include file (without any with_items loop), and write a main playbook task that uses an include ... with_items to call the include file once per port.
  • Importantly they'd need to set host: mywebserver.com. Commented Aug 5, 2017 at 18:18
  • @XiongChiamiov - host: x is not required. I just re-tested with Ansible 2.3.1 and the host attribute of wait_for tasks defaults to the current server being processed from inventory.
    – RichVel
    Commented Aug 6, 2017 at 9:02
  • Exactly, which is why OP needs to override it: they're testing connectivity to another webserver from all of their servers (re-read the question). Commented Aug 6, 2017 at 15:18
  • 2
    Good point, have updated the answer with hosts attribute.
    – RichVel
    Commented Aug 7, 2017 at 6:47
  • Thank you! This works for me, and gives me enough to work on.
    – AWhitaker
    Commented Aug 7, 2017 at 17:29

AFAIK there is no built-in module for this purpose, but you can use shell + nc:

- hosts: all
    - shell: nc -z -w 1 -G 1 my.hostname.com {{ item }} || echo "Port {{ item }} is closed"
      with_items: [80,443,8443]
  • 2
    Thank you, this works also, but I opted to go with first suggestion as it allows me to further customize the play.
    – AWhitaker
    Commented Aug 7, 2017 at 17:30
  • What is -G 1 I can't find it in the man pages?
    – lonix
    Commented Aug 27, 2019 at 7:15
  • @Ionix According to manpages.ubuntu.com/manpages/precise/en/man1/…, it's source-routing pointer
    – windyzboy
    Commented Oct 16, 2020 at 4:46

You can use wait_for module for the same

example quoted from the documentation:

- name: Wait 300 seconds for port 8000 of any IP to close active connections, don't start checking for 10 seconds
    port: 8000
    delay: 10
    state: drained
  • Please try to format your post properly, all site on StackExchange network allow the same markdown, documentation for formatting is here
    – Tensibai
    Commented Jul 17, 2018 at 11:06
  • 4
    BTW I fail too see what this answer adds which is not in RichVel answer already
    – Tensibai
    Commented Jul 17, 2018 at 11:07

We use our tool dda-serverspec (https://github.com/DomainDrivenArchitecture/dda-serverspec-crate) for such tasks. You may define your expectation

{:netcat [{:host "mywebserver.com" :port "443"} {:host "telnet mywebserver.com" :port "80"} {:host "telnet mywebserver.com" :port "8443"}]}

and test these expectation either against localhost or remote by ssh. For remote tests you've to define a targets:

{:existing [{:node-name "test-vm1"
:node-ip ""}
{:node-name "test-vm2" :node-ip ""}] :provisioning-user {:login "ubuntu"}}

You may run the test by java -jar dda-serverspec.jar --targets targets.edn serverspec.edn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.