diff --git a/roles/firewall/defaults/main.yaml b/roles/firewall/defaults/main.yaml
index 1737348..59c2f24 100644
--- a/roles/firewall/defaults/main.yaml
+++ b/roles/firewall/defaults/main.yaml
@@ -59,10 +59,10 @@ firewall_limit_icmp_flood_hitcount: 6
 
 firewall_loopback_notrack: true
 
-firewall_limited_tcp_ports: {}
+firewall_limited_tcp_ports: []
 
-firewall_allowed_tcp_ports: {}
-firewall_allowed_udp_ports: {}
+firewall_allowed_tcp_ports: []
+firewall_allowed_udp_ports: []
 
 firewall_log_limit: 3/min
 firewall_log_limit_burst: 10
@@ -73,52 +73,53 @@ firewall_limit_ssh_hitcount: 10
 
 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"
 
-firewall_ssh_whitelist: {}
+firewall_ssh_whitelist: []
 
 # ipset's
 firewall_ipset_cooloff_timeout: 600
 
-firewall_ipset_blacklist: {}
+firewall_ipset_blacklist: []
 
-firewall_ipset_mgmt: {}
+firewall_ipset_mgmt: []
 
 firewall_ipset_bogons:
-  v4:
-    - 0.0.0.0/8
-    - 10.0.0.0/8
-    - 100.64.0.0/10
-    - 127.0.0.0/8
-    - 169.254.0.0/16
-    - 172.16.0.0/12
-    - 192.0.0.0/24
-    - 192.0.2.0/24
-    - 192.168.0.0/16
-    - 198.18.0.0/15
-    - 198.51.100.0/24
-    - 203.0.113.0/24
-    - 224.0.0.0/4
-    - 240.0.0.0/4
-  v6:
-    - ::/96
-    - ::/128
-    - ::1/128
-    - ::ffff:0.0.0.0/96
-    - ::224.0.0.0/100
-    - ::127.0.0.0/104
-    - ::0.0.0.0/104
-    - ::255.0.0.0/104
-    - 0000::/8
-    - 0200::/7
-    - 3ffe::/16
-    - 2001:db8::/32
-    - 2002:e000::/20
-    - 2002:7f00::/24
-    - 2002:0000::/24
-    - 2002:ff00::/24
-    - 2002:0a00::/24
-    - 2002:ac10::/28
-    - 2002:c0a8::/32
-    - fc00::/7
-    - fe80::/10
-    - fec0::/10
-    - ff00::/8
+  - 0.0.0.0/8
+  - 10.0.0.0/8
+  - 100.64.0.0/10
+  - 127.0.0.0/8
+  - 169.254.0.0/16
+  - 172.16.0.0/12
+  - 192.0.0.0/24
+  - 192.0.2.0/24
+  - 192.168.0.0/16
+  - 198.18.0.0/15
+  - 198.51.100.0/24
+  - 203.0.113.0/24
+  - 224.0.0.0/4
+  - 240.0.0.0/4
+  - ::/96
+  - ::/128
+  - ::1/128
+  - ::ffff:0.0.0.0/96
+  - ::224.0.0.0/100
+  - ::127.0.0.0/104
+  - ::0.0.0.0/104
+  - ::255.0.0.0/104
+  - 0000::/8
+  - 0200::/7
+  - 3ffe::/16
+  - 2001:db8::/32
+  - 2002:e000::/20
+  - 2002:7f00::/24
+  - 2002:0000::/24
+  - 2002:ff00::/24
+  - 2002:0a00::/24
+  - 2002:ac10::/28
+  - 2002:c0a8::/32
+  - fc00::/7
+  - fe80::/10
+  - fec0::/10
+  - ff00::/8
+
+firewall_allowed_icmp_types: []
+firewall_allowed_icmpv6_types: []
diff --git a/roles/firewall/templates/ip6tables.j2 b/roles/firewall/templates/ip6tables.j2
index 94a9450..0993144 100644
--- a/roles/firewall/templates/ip6tables.j2
+++ b/roles/firewall/templates/ip6tables.j2
@@ -50,19 +50,19 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
-{% if firewall_ssh_whitelist.v6 %}
-{% for ip in firewall_ssh_whitelist.v6 %}
+{% if firewall_ssh_whitelist | length %}
+{% for ip in firewall_ssh_whitelist | ipv6 %}
 -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
 {% endfor %}
 {% endif %}
 
-{% if firewall_ipset_mgmt.v6 is defined %}
+{% if firewall_ipset_mgmt | length %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
 
-{% if firewall_ipset_blacklist.v6 is defined %}
+{% if firewall_ipset_blacklist | length %}
 -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
 {% endif %}
 
@@ -96,7 +96,7 @@
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
 
-{% if firewall_ipset_bogons.v6 is defined %}
+{% if firewall_ipset_bogons | length %}
 -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
 {% endif %}
 
@@ -106,13 +106,17 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
-{% for port in firewall_allowed_tcp_ports.v6 | default([]) %}
+{% if firewall_allowed_tcp_ports | length %}
+{% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
 {% endfor %}
+{% endif %}
 
-{% for port in firewall_allowed_udp_ports.v6 | default([]) %}
+{% if firewall_allowed_udp_ports | length %}
+{% for port in firewall_allowed_udp_ports %}
 -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT
 
diff --git a/roles/firewall/templates/ipset.v4.j2 b/roles/firewall/templates/ipset.v4.j2
index 81c963a..8804754 100644
--- a/roles/firewall/templates/ipset.v4.j2
+++ b/roles/firewall/templates/ipset.v4.j2
@@ -1,15 +1,17 @@
 {% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
 create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
 flush {{ name }}
-{% for ip_or_net in ipset | default([]) %}
+{% if ipset | length %}
+{% for ip_or_net in ipset | ipv4 %}
 add {{ name }} {{ ip_or_net }}
 {% endfor %}
+{% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }}
 
-{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }}
 
-{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }}
 
 {{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
diff --git a/roles/firewall/templates/ipset.v6.j2 b/roles/firewall/templates/ipset.v6.j2
index 7520594..32fab0e 100644
--- a/roles/firewall/templates/ipset.v6.j2
+++ b/roles/firewall/templates/ipset.v6.j2
@@ -1,15 +1,17 @@
 {% macro render_ipset(ipset, name, type="hash:net", family="inet6", timeout=None) %}
 create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
 flush {{ name }}
-{% for ip_or_net in ipset | default([]) %}
+{% if ipset | length %}
+{% for ip_or_net in ipset | ipv6 %}
 add {{ name }} {{ ip_or_net }}
 {% endfor %}
+{% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }}
 
-{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }}
 
-{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }}
 
 {{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
diff --git a/roles/firewall/templates/iptables.j2 b/roles/firewall/templates/iptables.j2
index 9e109e6..5a38591 100644
--- a/roles/firewall/templates/iptables.j2
+++ b/roles/firewall/templates/iptables.j2
@@ -50,23 +50,23 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
-{% if firewall_ssh_whitelist.v4 %}
-{% for ip in firewall_ssh_whitelist.v4 %}
+{% if firewall_ssh_whitelist | length %}
+{% for ip in firewall_ssh_whitelist | ipv4 %}
 -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
 {% endfor %}
 {% endif %}
 
-{% if firewall_ipset_mgmt.v4 is defined %}
+{% if firewall_ipset_mgmt | length %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
 {% endif %}
 
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
-{% if firewall_ipset_blacklist.v4 is defined %}
+{% if firewall_ipset_blacklist | length %}
 -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
 {% endif %}
 
-{% if firewall_ipset_bogons.v4 is defined %}
+{% if firewall_ipset_bogons | length %}
 -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
 {% endif %}
 
@@ -80,9 +80,11 @@
 {% endif %}
 -A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
 
-{% for type in firewall_allowed_icmp_types.v4 | default([]) %}
+{% if firewall_allowed_icmp_types | length %}
+{% for type in firewall_allowed_icmp_types | ipv4 %}
 -A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 {% if firewall_limit_ssh %}
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH
@@ -90,13 +92,17 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
 {% endif %}
 
-{% for port in firewall_allowed_tcp_ports.v4 | default([]) %}
+{% if firewall_allowed_tcp_ports | length %}
+{% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
 {% endfor %}
+{% endif %}
 
-{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
+{% if firewall_allowed_udp_ports | length %}
+{% for port in firewall_allowed_udp_ports %}
 -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT