Simplify firewall IP and network lists

roles/firewall/templates/ip6tables.j2

@@ -50,19 +50,19 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
-{% if firewall_ssh_whitelist.v6 %}
-{% for ip in firewall_ssh_whitelist.v6 %}
+{% if firewall_ssh_whitelist | length %}
+{% for ip in firewall_ssh_whitelist | ipv6 %}
 -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp6" -j ACCEPT
 {% endfor %}
 {% endif %}
 
-{% if firewall_ipset_mgmt.v6 is defined %}
+{% if firewall_ipset_mgmt | length %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
 
-{% if firewall_ipset_blacklist.v6 is defined %}
+{% if firewall_ipset_blacklist | length %}
 -A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
 {% endif %}
 
@@ -96,7 +96,7 @@
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 148 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 148" -j ACCEPT
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
 
-{% if firewall_ipset_bogons.v6 is defined %}
+{% if firewall_ipset_bogons | length %}
 -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
 {% endif %}
 
@@ -106,13 +106,17 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
-{% for port in firewall_allowed_tcp_ports.v6 | default([]) %}
+{% if firewall_allowed_tcp_ports | length %}
+{% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
 {% endfor %}
+{% endif %}
 
-{% for port in firewall_allowed_udp_ports.v6 | default([]) %}
+{% if firewall_allowed_udp_ports | length %}
+{% for port in firewall_allowed_udp_ports %}
 -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp6" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established inet6" -j ACCEPT
 

roles/firewall/templates/ipset.v4.j2

@@ -1,15 +1,17 @@
 {% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
 create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
 flush {{ name }}
-{% for ip_or_net in ipset | default([]) %}
+{% if ipset | length %}
+{% for ip_or_net in ipset | ipv4 %}
 add {{ name }} {{ ip_or_net }}
 {% endfor %}
+{% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt.v4, 'mgmt_v4') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }}
 
-{{ render_ipset(firewall_ipset_blacklist.v4, 'blacklist_v4') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }}
 
-{{ render_ipset(firewall_ipset_bogons.v4, 'bogons_v4') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }}
 
 {{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}

roles/firewall/templates/ipset.v6.j2

@@ -1,15 +1,17 @@
 {% macro render_ipset(ipset, name, type="hash:net", family="inet6", timeout=None) %}
 create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
 flush {{ name }}
-{% for ip_or_net in ipset | default([]) %}
+{% if ipset | length %}
+{% for ip_or_net in ipset | ipv6 %}
 add {{ name }} {{ ip_or_net }}
 {% endfor %}
+{% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt.v6, 'mgmt_v6') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }}
 
-{{ render_ipset(firewall_ipset_blacklist.v6, 'blacklist_v6') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }}
 
-{{ render_ipset(firewall_ipset_bogons.v6, 'bogons_v6') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }}
 
 {{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}

roles/firewall/templates/iptables.j2

@@ -50,23 +50,23 @@
 
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
-{% if firewall_ssh_whitelist.v4 %}
-{% for ip in firewall_ssh_whitelist.v4 %}
+{% if firewall_ssh_whitelist | length %}
+{% for ip in firewall_ssh_whitelist | ipv4 %}
 -A INPUT -p tcp -m tcp --dport 22 --source {{ ip }} -m comment --comment "accept {{ ip }} ssh 22/tcp" -j ACCEPT
 {% endfor %}
 {% endif %}
 
-{% if firewall_ipset_mgmt.v4 is defined %}
+{% if firewall_ipset_mgmt | length %}
 -A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
 {% endif %}
 
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
-{% if firewall_ipset_blacklist.v4 is defined %}
+{% if firewall_ipset_blacklist | length %}
 -A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
 {% endif %}
 
-{% if firewall_ipset_bogons.v4 is defined %}
+{% if firewall_ipset_bogons | length %}
 -A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
 {% endif %}
 
@@ -80,9 +80,11 @@
 {% endif %}
 -A INPUT -p icmp -m icmp --icmp-type echo-reply -m comment --comment "accept icmp echo-reply" -j ACCEPT
 
-{% for type in firewall_allowed_icmp_types.v4 | default([]) %}
+{% if firewall_allowed_icmp_types | length %}
+{% for type in firewall_allowed_icmp_types | ipv4 %}
 -A INPUT -p icmp -m icmp --icmp-type {{ type }} -m comment --comment "accept icmp {{ type }}" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 {% if firewall_limit_ssh %}
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j LIMIT_SSH
@@ -90,13 +92,17 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
 {% endif %}
 
-{% for port in firewall_allowed_tcp_ports.v4 | default([]) %}
+{% if firewall_allowed_tcp_ports | length %}
+{% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
 {% endfor %}
+{% endif %}
 
-{% for port in firewall_allowed_udp_ports.v4 | default([]) %}
+{% if firewall_allowed_udp_ports | length %}
+{% for port in firewall_allowed_udp_ports %}
 -A INPUT -p udp -m udp --dport {{ port }} -m comment --comment "accept {{ port }}/udp" -j ACCEPT
 {% endfor %}
+{% endif %}
 
 -A INPUT -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT