Repository: ansible/ansible-modules-extras

Issue:
iptables module docs and examples
it looks like several bits of the documentation are copied multiple times (for example in the 'destination' bit)

also, could there be an example of how to write what would generate 
"iptables -t nat -A POSTROUTING -s 10.0.0.0/24 ! -d 10.0.0.0/24 -j MASQUERADE"

I can't seem to write something that would do that...



Discussion:
 @sxpert  I think with the current iptables module we cannot achieve what you are trying to do, because of the ! before destination. You can achieve the below rule
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 10.0.0.0/24 -j MASQUERADE
with
- iptables: table=nat chain=POSTROUTING protocol=tcp source=10.0.0.0/24 jump=MASQUERADE destination=10.0.0.0/24

I guess we need new parameter or a flag for these iptables parameters -s, -d, -p, -i, -o,-f to support inverting

in fact this pull request of mine fixes it ;-)
https://github.com/ansible/ansible-modules-extras/pull/1685

cool, I will test it :-)

@LinusU, ping. This issue is still waiting on your response.
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)

<!--- boilerplate: issue_renotify_maintainer --->


Resolving patch:
diff --git a/system/iptables.py b/system/iptables.py
--- a/system/iptables.py
+++ b/system/iptables.py
@@ -98,15 +98,7 @@
         either a network mask or a plain number, specifying the number of 1's
         at the left side of the network mask. Thus, a mask of 24 is equivalent
         to 255.255.255.0. A "!" argument before the address specification
-        inverts the sense of the address.Source specification. Address can be
-        either a network name, a hostname, a network IP address (with /mask),
-        or a plain IP address.  Hostnames will be resolved once only, before
-        the rule is submitted to the kernel. Please note that specifying any
-        name to be resolved with a remote query such as DNS is a really bad
-        idea. The mask can be either a network mask or a plain number,
-        specifying the number of 1's at the left side of the network mask.
-        Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument
-        before the address specification inverts the sense of the address.
+        inverts the sense of the address.
     required: false
     default: null
   destination:
@@ -119,15 +111,7 @@
         either a network mask or a plain number, specifying the number of 1's
         at the left side of the network mask. Thus, a mask of 24 is equivalent
         to 255.255.255.0. A "!" argument before the address specification
-        inverts the sense of the address.Source specification. Address can be
-        either a network name, a hostname, a network IP address (with /mask),
-        or a plain IP address. Hostnames will be resolved once only, before
-        the rule is submitted to the kernel. Please note that specifying any
-        name to be resolved with a remote query such as DNS is a really bad
-        idea. The mask can be either a network mask or a plain number,
-        specifying the number of 1's at the left side of the network mask.
-        Thus, a mask of 24 is equivalent to 255.255.255.0. A "!" argument
-        before the address specification inverts the sense of the address.
+        inverts the sense of the address.
     required: false
     default: null
   match:


Test patch: