unbound: configure as a forwarded that accepts connections

roles/dns/defaults/main.yaml

@@ -6,6 +6,14 @@ unbound_service_name: 'unbound'
 unbound_service_state: 'started'
 unbound_service_enabled: yes
 
+unbound_interfaces:
+  - 127.0.0.1
+  - ::1
+
+unbound_access_control:
+  - 127.0.0.1 allow
+  - ::1 allow
+
 unbound_forward_zones:
   - name: .
     forward_addr:

roles/dns/handlers/main.yaml

@@ -5,4 +5,10 @@
     state: reloaded
   when: unbound_service_enabled
 
+- name: restart unbound
+  service:
+    name: "{{ unbound_service_name }}"
+    state: restarted
+  when: unbound_service_enabled
+
 # vim:ft=yaml.ansible:

roles/dns/tasks/main.yaml

@@ -1,14 +1,46 @@
 ---
+- name: gather os specific variables
+  include_vars: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - vars
+
+- name: include os specific tasks
+  include_tasks: "{{ lookup('first_found', possible_files) }}"
+  vars:
+    possible_files:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
+        - "{{ ansible_distribution }}.yaml"
+        - "{{ ansible_os_family }}.yaml"
+        - "default.yaml"
+      paths:
+        - tasks
+
 - name: install unbound
   package:
     name: "{{ unbound_package_name }}"
     state: "{{ unbound_package_state }}"
 
-- name: configure unbound
+- name: configure unbound interfaces
+  template:
+    src: listen.conf.j2
+    dest: "{{ unbound_conf_d_path }}/listen.conf"
+    validate: "{{ unbound_checkconf_command }}"
+  notify:
+    - restart unbound
+
+- name: configure unbound forward zones
   template:
     src: forward.conf.j2
-    dest: /etc/unbound/unbound.conf.d/forward.conf
+    dest: "{{ unbound_conf_d_path }}/forward.conf"
-    validate: 'unbound-checkconf %s'
+    validate: "{{ unbound_checkconf_command }}"
   notify:
     - reload unbound
 

roles/dns/templates/listen.conf.j2

@@ -0,0 +1,9 @@
+server:
+{% if unbound_interfaces is defined %}
+{%   for iface in unbound_interfaces | default([]) %}
+  interface: {{ iface }}
+{%   endfor %}
+{%   for ac in unbound_access_control | default([]) %}
+  access-control: {{ ac }}
+{%   endfor %}
+{% endif %}

roles/dns/vars/Debian.yaml

@@ -0,0 +1,3 @@
+---
+unbound_conf_d_path: /etc/unbound/unbound.conf.d
+unbound_checkconf_command: unbound-checkconf %s

roles/dns/vars/RedHat.yaml

@@ -1,3 +1,5 @@
 ---
+unbound_conf_d_path: /etc/unbound/conf.d
+unbound_checkconf_command: 'true %s'
 
 # vim:ft=yaml.ansible:

roles/firewall/defaults/main.yaml

@@ -2,6 +2,7 @@
 firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp
 firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp
 
+firewall_ipset: /etc/iptables/ipset-tmp
 firewall_ipset_v4: /etc/iptables/ipset.v4-tmp
 firewall_ipset_v6: /etc/iptables/ipset.v6-tmp
 
@@ -68,7 +69,7 @@ firewall_log_limit: 3/min
 firewall_log_limit_burst: 10
 
 firewall_limit_ssh: true
-firewall_limit_ssh_seconds: 60
+firewall_limit_ssh_seconds: 600
 firewall_limit_ssh_hitcount: 10
 
 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"

roles/firewall/handlers/main.yaml

@@ -13,21 +13,18 @@
 - name: ip6tables-restore
   command: ip6tables-restore {{ firewall_iptables_rules_v6 }}
 
+- name: reload ipset
+  shell: ipset restore -exist -file {{ firewall_ipset }}
+
 - name: restart firewall v4
-  command: "{{ item }}"
+  shell: "{{ item }}"
   loop:
-    - iptables-restore /etc/iptables/clear.v4
+    - iptables-restore --test {{ firewall_iptables_rules_v4 }} && iptables-restore {{ firewall_iptables_rules_v4 }}
-    - ipset restore -file {{ firewall_ipset_v4 }}
-    - iptables-restore --test {{ firewall_iptables_rules_v4 }}
-    - iptables-restore {{ firewall_iptables_rules_v4 }}
 
 - name: restart firewall v6
-  command: "{{ item }}"
+  shell: "{{ item }}"
   loop:
-    - ip6tables-restore /etc/iptables/clear.v6
+    - ip6tables-restore --test {{ firewall_iptables_rules_v6 }} && ip6tables-restore {{ firewall_iptables_rules_v6 }}
-    - ipset restore -file {{ firewall_ipset_v6 }}
-    - ip6tables-restore --test {{ firewall_iptables_rules_v6 }}
-    - ip6tables-restore {{ firewall_iptables_rules_v6 }}
 
 - name: iptables-persistent
   command: /usr/sbin/netfilter-persistent save

roles/firewall/tasks/main.yaml

@@ -63,15 +63,15 @@
     - clear.v4
     - clear.v6
 
-- name: configure IPv4 ipsets
+- name: configure ipsets
   template:
-    src: ipset.v4.j2
+    src: ipset.j2
-    dest: "{{ firewall_ipset_v4 }}"
+    dest: "{{ firewall_ipset }}"
     owner: root
     group: root
     mode: 0600
   notify:
-    - restart firewall v4
+    - reload ipset
     - iptables-persistent
 
 - name: configure IPv4 firewall
@@ -85,17 +85,6 @@
     - restart firewall v4
     - iptables-persistent
 
-- name: configure IPv6 ipsets
-  template:
-    src: ipset.v6.j2
-    dest: "{{ firewall_ipset_v6 }}"
-    owner: root
-    group: root
-    mode: 0600
-  notify:
-    - restart firewall v6
-    - iptables-persistent
-
 - name: configure IPv6 firewall
   template:
     src: ip6tables.j2

roles/firewall/templates/ip6tables.j2

@@ -23,16 +23,31 @@
 -A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP
 -A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited
 
+{% if "wireguard" in ansible_play_role_names %}
+{%   for name, conf in wireguard_interfaces.items() %}
+-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
+{%   endfor %}
+{%   for name, conf in wireguard_iptables.items() %}
+{%     if "input" in conf and conf.input %}
+-A INPUT -i {{ name }} -j LOG_ACCEPT
+{%     endif %}
+{%     if "dns" in conf and conf.dns %}
+-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
+-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
+{%     endif %}
+{%   endfor %}
+{% endif %}
+
 {% if firewall_limit_ssh %}
 -N LIMIT_SSH
--A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
+-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
 -A LIMIT_SSH -m recent --set --name SSH --rsource
 {% if firewall_use_ulogd %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
 {% else %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
 {% endif %}
--A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v6 src
+-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff6 src
 -A LIMIT_SSH -j ACCEPT
 {% endif %}
 
@@ -48,16 +63,6 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
-{% if firewall_dns_whitelist is defined and
-      firewall_dns_whitelist | length %}
--N ACCEPT_DNS
-{% for ip in firewall_dns_whitelist | ipv6 %}
--A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
--A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
-{% endfor %}
--A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
-{% endif %}
-
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -67,21 +72,13 @@
 {% endif %}
 
 {% if firewall_ipset_mgmt | length %}
--A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
-{% endif %}
-
-{% if firewall_dns_whitelist is defined and
-      firewall_dns_whitelist | length %}
--A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
--A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
 {% endif %}
 
+-A INPUT -m set --match-set block6 src -m comment --comment "drop block6" -j LOG_DROP
+-A INPUT -m set --match-set gray6 src -m comment --comment "drop gray6" -j LOG_DROP
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
 
-{% if firewall_ipset_blacklist | length %}
--A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
-{% endif %}
-
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT
@@ -113,7 +110,7 @@
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
 
 {% if firewall_ipset_bogons | length %}
--A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
 {% endif %}
 
 {% if firewall_limit_ssh %}
@@ -122,6 +119,32 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
+{% if firewall_ipset_node_exporter is defined %}
+-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter6 src -m comment --comment "accept node_exporter 9100/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_blackbox_exporter is defined %}
+-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter6 src -m comment --comment "accept blackbox_exporter 9115/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_mtail is defined %}
+-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail6 src -m comment --comment "accept mtail 3903/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_syslog is defined %}
+-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog6 src -m comment --comment "accept syslog 514/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_influxdb is defined %}
+-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb6 src -m comment --comment "accept influxdb 8086/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_dns is defined %}
+-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT
+-A INPUT -p udp -m udp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_loki is defined %}
+-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki6 src -m comment --comment "accept loki 3100/tcp6" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_promtail is defined %}
+-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail6 src -m comment --comment "accept promtail 9080/tcp6" -j LOG_ACCEPT
+{% endif %}
+
 {% if firewall_allowed_tcp_ports | length %}
 {% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
@@ -152,7 +175,15 @@
 
 -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP
 
--A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP
+{% if "wireguard" in ansible_play_role_names %}
+{%   for name, conf in wireguard_iptables.items() %}
+{%     if "forward" in conf and conf.forward %}
+-A FORWARD -i {{ name }} -o eth0 -j ACCEPT
+{%      endif %}
+{%   endfor %}
+{% endif %}
+-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
+-A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
 
 -A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT
 COMMIT

roles/firewall/templates/ipset.j2

@@ -0,0 +1,48 @@
+{% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
+create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
+flush {{ name }}
+{%   if ipset is iterable %}
+{%     for ip_or_net in ipset %}
+add {{ name }} {{ ip_or_net }}
+{%     endfor %}
+{%   endif %}
+{% endmacro %}
+
+{% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
+{{ render_ipset(ipset | ipv4, name + "4", type=type, family=family, timeout=timeout) }}
+{{ render_ipset(ipset | ipv6, name + "6", type=type, family="inet6", timeout=timeout) }}
+{% endmacro %}
+
+{{ render_dual_stack_ipset([], 'block') }}
+{{ render_dual_stack_ipset([], 'gray', type="hash:ip", timeout=600) }}
+{{ render_dual_stack_ipset([], 'cooloff', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+{% if firewall_ipset_mgmt is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_mgmt, 'mgmt') }}
+{% endif %}
+{% if firewall_ipset_bogons is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_bogons, 'bogons') }}
+{% endif %}
+{% if firewall_ipset_node_exporter is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_node_exporter, 'node_exporter') }}
+{% endif %}
+{% if firewall_ipset_blackbox_exporter is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter') }}
+{% endif %}
+{% if firewall_ipset_mtail is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_mtail, 'mtail') }}
+{% endif %}
+{% if firewall_ipset_syslog is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_syslog, 'syslog') }}
+{% endif %}
+{% if firewall_ipset_influxdb is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_influxdb, 'influxdb') }}
+{% endif %}
+{% if firewall_ipset_dns is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_dns, 'dns') }}
+{% endif %}
+{% if firewall_ipset_loki is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_loki, 'loki') }}
+{% endif %}
+{% if firewall_ipset_promtail is defined %}
+{{ render_dual_stack_ipset(firewall_ipset_promtail, 'promtail') }}
+{% endif %}

roles/firewall/templates/ipset.v4.j2

@@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }}
 {% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt4') }}
 
-{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }}
+{{ render_ipset([], 'blacklist4') }}
+{{ render_ipset([], 'graylist4', type="hash:ip", timeout=600) }}
 
-{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons4') }}
 
-{{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+{{ render_ipset([], 'cooloff4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+
+{% if firewall_ipset_node_exporter is defined %}
+{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter4') }}
+{% endif %}
+{% if firewall_ipset_blackbox_exporter is defined %}
+{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter4') }}
+{% endif %}
+{% if firewall_ipset_mtail is defined %}
+{{ render_ipset(firewall_ipset_mtail, 'mtail4') }}
+{% endif %}
+{% if firewall_ipset_syslog is defined %}
+{{ render_ipset(firewall_ipset_syslog, 'syslog4') }}
+{% endif %}
+{% if firewall_ipset_influxdb is defined %}
+{{ render_ipset(firewall_ipset_influxdb, 'influxdb4') }}
+{% endif %}
+{% if firewall_ipset_dns is defined %}
+{{ render_ipset(firewall_ipset_dns, 'dns4') }}
+{% endif %}

roles/firewall/templates/ipset.v6.j2

@@ -8,10 +8,30 @@ add {{ name }} {{ ip_or_net }}
 {% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt6') }}
 
-{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }}
+{{ render_ipset([], 'blacklist6') }}
+{{ render_ipset([], 'graylist6', type="hash:ip", timeout=600) }}
 
-{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons6') }}
 
-{{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+{{ render_ipset([], 'cooloff6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+
+{% if firewall_ipset_node_exporter is defined %}
+{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter6') }}
+{% endif %}
+{% if firewall_ipset_blackbox_exporter is defined %}
+{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter6') }}
+{% endif %}
+{% if firewall_ipset_mtail is defined %}
+{{ render_ipset(firewall_ipset_mtail, 'mtail6') }}
+{% endif %}
+{% if firewall_ipset_syslog is defined %}
+{{ render_ipset(firewall_ipset_syslog, 'syslog6') }}
+{% endif %}
+{% if firewall_ipset_influxdb is defined %}
+{{ render_ipset(firewall_ipset_influxdb, 'influxdb6') }}
+{% endif %}
+{% if firewall_ipset_dns is defined %}
+{{ render_ipset(firewall_ipset_dns, 'dns6') }}
+{% endif %}

roles/firewall/templates/iptables.j2

@@ -23,16 +23,31 @@
 -A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP
 -A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited
 
+{% if "wireguard" in ansible_play_role_names %}
+{%   for name, conf in wireguard_interfaces.items() %}
+-A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
+{%   endfor %}
+{%   for name, conf in wireguard_iptables.items() %}
+{%     if "input" in conf and conf.input %}
+-A INPUT -i {{ name }} -j LOG_ACCEPT
+{%     endif %}
+{%     if "dns" in conf and conf.dns %}
+-A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
+-A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
+{%     endif %}
+{%   endfor %}
+{% endif %}
+
 {% if firewall_limit_ssh %}
 -N LIMIT_SSH
--A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
+-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
 -A LIMIT_SSH -m recent --set --name SSH --rsource
 {% if firewall_use_ulogd %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
 {% else %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
 {% endif %}
--A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v4 src
+-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff4 src
 -A LIMIT_SSH -j ACCEPT
 {% endif %}
 
@@ -48,34 +63,6 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
-{% if firewall_dns_whitelist is defined and
-      firewall_dns_whitelist | length %}
--N ACCEPT_DNS
-{% for ip in firewall_dns_whitelist | ipv4 %}
--A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
--A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
-{% endfor %}
--A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
-{% endif %}
-
-{% if firewall_influx_whitelist is defined and
-      firewall_influx_whitelist | length %}
--N ACCEPT_INFLUX
-{% for ip in firewall_influx_whitelist | ipv4 %}
--A ACCEPT_INFLUX -m tcp -p tcp --dport 8086 --source {{ ip }} -m comment --comment "accept {{ ip }} influxdb 8086/tcp" -j LOG_ACCEPT
-{% endfor %}
--A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP
-{% endif %}
-
-{% if firewall_syslog_whitelist is defined and
-      firewall_syslog_whitelist | length %}
--N ACCEPT_SYSLOG
-{% for ip in firewall_syslog_whitelist | ipv4 %}
--A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT
-{% endfor %}
--A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP
-{% endif %}
-
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -85,33 +72,15 @@
 {% endif %}
 
 {% if firewall_ipset_mgmt | length %}
--A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
-{% endif %}
-
-{% if firewall_dns_whitelist is defined and
-      firewall_dns_whitelist | length %}
--A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
--A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
-{% endif %}
-
-{% if firewall_influx_whitelist is defined and
-      firewall_influx_whitelist | length %}
--A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX
-{% endif %}
-
-{% if firewall_syslog_whitelist is defined and
-      firewall_syslog_whitelist | length %}
--A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG
 {% endif %}
 
+-A INPUT -m set --match-set block4 src -m comment --comment "drop block4" -j LOG_DROP
+-A INPUT -m set --match-set gray4 src -m comment --comment "drop gray4" -j LOG_DROP
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
-{% if firewall_ipset_blacklist | length %}
--A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
-{% endif %}
-
 {% if firewall_ipset_bogons | length %}
--A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
 {% endif %}
 
 -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
@@ -136,6 +105,33 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
 {% endif %}
 
+{% if firewall_ipset_node_exporter is defined %}
+-A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter4 src -m comment --comment "accept node_exporter 9100/tcp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_blackbox_exporter is defined %}
+-A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter4 src -m comment --comment "accept blackbox_exporter 9115/tcp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_mtail is defined %}
+-A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail4 src -m comment --comment "accept mtail 3903/tcp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_syslog is defined %}
+-A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/tcp" -j LOG_ACCEPT
+-A INPUT -p udp -m udp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/udp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_influxdb is defined %}
+-A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb4 src -m comment --comment "accept influxdb 8086/tcp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_dns is defined %}
+-A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT
+-A INPUT -p udp -m udp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_loki is defined %}
+-A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki4 src -m comment --comment "accept loki 3100/tcp" -j LOG_ACCEPT
+{% endif %}
+{% if firewall_ipset_promtail is defined %}
+-A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail4 src -m comment --comment "accept promtail 9080/tcp" -j LOG_ACCEPT
+{% endif %}
+
 {% if firewall_allowed_tcp_ports | length %}
 {% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
@@ -166,6 +162,14 @@
 
 -A INPUT -m comment --comment "default drop" -j LOG_DROP
 
+{% if "wireguard" in ansible_play_role_names %}
+{%   for name, conf in wireguard_iptables.items() %}
+{%     if "forward" in conf and conf.forward %}
+-A FORWARD -i {{ name }} -o eth0 -j ACCEPT
+{%      endif %}
+{%   endfor %}
+{% endif %}
+-A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
 -A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
 
 -A OUTPUT -m comment --comment "default output accept" -j ACCEPT
@@ -180,4 +184,18 @@ COMMIT
 {% endif %}
 COMMIT
 
+*nat
+:PREROUTING ACCEPT -
+:INPUT ACCEPT -
+:OUTPUT ACCEPT -
+:POSTROUTING ACCEPT -
+
+{% if "wireguard" in ansible_play_role_names %}
+{%   for name, conf in wireguard_iptables.items() %}
+{%     if "nat" in conf %}
+-A POSTROUTING -o {{ conf.nat.out_iface }} -s {{ conf.nat.source }} -j MASQUERADE
+{%     endif %}
+{%   endfor %}
+{% endif %}
+COMMIT
 # vim: tw=0