roles/dns/defaults/main.yaml

@@ -6,14 +6,6 @@ unbound_service_name: 'unbound'
 unbound_service_state: 'started'
 unbound_service_enabled: yes
 
-unbound_interfaces:
-  - 127.0.0.1
-  - ::1
-
-unbound_access_control:
-  - 127.0.0.1 allow
-  - ::1 allow
-
 unbound_forward_zones:
   - name: .
     forward_addr:

roles/dns/handlers/main.yaml

@@ -5,10 +5,4 @@
     state: reloaded
   when: unbound_service_enabled
 
-- name: restart unbound
-  service:
-    name: "{{ unbound_service_name }}"
-    state: restarted
-  when: unbound_service_enabled
-
 # vim:ft=yaml.ansible:

roles/dns/tasks/main.yaml

@@ -1,46 +1,14 @@
 ---
-- name: gather os specific variables
-  include_vars: "{{ lookup('first_found', possible_files) }}"
-  vars:
-    possible_files:
-      files:
-        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
-        - "{{ ansible_distribution }}.yaml"
-        - "{{ ansible_os_family }}.yaml"
-        - "default.yaml"
-      paths:
-        - vars
-
-- name: include os specific tasks
-  include_tasks: "{{ lookup('first_found', possible_files) }}"
-  vars:
-    possible_files:
-      files:
-        - "{{ ansible_distribution }}-{{ ansible_distribution_version }}.yaml"
-        - "{{ ansible_distribution }}.yaml"
-        - "{{ ansible_os_family }}.yaml"
-        - "default.yaml"
-      paths:
-        - tasks
-
 - name: install unbound
   package:
     name: "{{ unbound_package_name }}"
     state: "{{ unbound_package_state }}"
 
-- name: configure unbound interfaces
+- name: configure unbound
-  template:
-    src: listen.conf.j2
-    dest: "{{ unbound_conf_d_path }}/listen.conf"
-    validate: "{{ unbound_checkconf_command }}"
-  notify:
-    - restart unbound
-
-- name: configure unbound forward zones
   template:
     src: forward.conf.j2
-    dest: "{{ unbound_conf_d_path }}/forward.conf"
+    dest: /etc/unbound/unbound.conf.d/forward.conf
-    validate: "{{ unbound_checkconf_command }}"
+    validate: 'unbound-checkconf %s'
   notify:
     - reload unbound
 

roles/dns/templates/listen.conf.j2

@@ -1,9 +0,0 @@
-server:
-{% if unbound_interfaces is defined %}
-{%   for iface in unbound_interfaces | default([]) %}
-  interface: {{ iface }}
-{%   endfor %}
-{%   for ac in unbound_access_control | default([]) %}
-  access-control: {{ ac }}
-{%   endfor %}
-{% endif %}

roles/dns/vars/Debian.yaml

@@ -1,3 +0,0 @@
----
-unbound_conf_d_path: /etc/unbound/unbound.conf.d
-unbound_checkconf_command: unbound-checkconf %s

roles/dns/vars/RedHat.yaml

@@ -1,5 +1,3 @@
 ---
-unbound_conf_d_path: /etc/unbound/conf.d
-unbound_checkconf_command: 'true %s'
 
 # vim:ft=yaml.ansible:

roles/firewall/defaults/main.yaml

@@ -2,7 +2,6 @@
 firewall_iptables_rules_v4: /etc/iptables/rules.v4-tmp
 firewall_iptables_rules_v6: /etc/iptables/rules.v6-tmp
 
-firewall_ipset: /etc/iptables/ipset-tmp
 firewall_ipset_v4: /etc/iptables/ipset.v4-tmp
 firewall_ipset_v6: /etc/iptables/ipset.v6-tmp
 
@@ -69,7 +68,7 @@ firewall_log_limit: 3/min
 firewall_log_limit_burst: 10
 
 firewall_limit_ssh: true
-firewall_limit_ssh_seconds: 600
+firewall_limit_ssh_seconds: 60
 firewall_limit_ssh_hitcount: 10
 
 firewall_bogon_interface: "{{ ansible_default_ipv4.interface }}"

roles/firewall/handlers/main.yaml

@@ -13,18 +13,21 @@
 - name: ip6tables-restore
   command: ip6tables-restore {{ firewall_iptables_rules_v6 }}
 
-- name: reload ipset
-  shell: ipset restore -exist -file {{ firewall_ipset }}
-
 - name: restart firewall v4
-  shell: "{{ item }}"
+  command: "{{ item }}"
   loop:
-    - iptables-restore --test {{ firewall_iptables_rules_v4 }} && iptables-restore {{ firewall_iptables_rules_v4 }}
+    - iptables-restore /etc/iptables/clear.v4
+    - ipset restore -file {{ firewall_ipset_v4 }}
+    - iptables-restore --test {{ firewall_iptables_rules_v4 }}
+    - iptables-restore {{ firewall_iptables_rules_v4 }}
 
 - name: restart firewall v6
-  shell: "{{ item }}"
+  command: "{{ item }}"
   loop:
-    - ip6tables-restore --test {{ firewall_iptables_rules_v6 }} && ip6tables-restore {{ firewall_iptables_rules_v6 }}
+    - ip6tables-restore /etc/iptables/clear.v6
+    - ipset restore -file {{ firewall_ipset_v6 }}
+    - ip6tables-restore --test {{ firewall_iptables_rules_v6 }}
+    - ip6tables-restore {{ firewall_iptables_rules_v6 }}
 
 - name: iptables-persistent
   command: /usr/sbin/netfilter-persistent save

roles/firewall/tasks/main.yaml

@@ -63,15 +63,15 @@
     - clear.v4
     - clear.v6
 
-- name: configure ipsets
+- name: configure IPv4 ipsets
   template:
-    src: ipset.j2
+    src: ipset.v4.j2
-    dest: "{{ firewall_ipset }}"
+    dest: "{{ firewall_ipset_v4 }}"
     owner: root
     group: root
     mode: 0600
   notify:
-    - reload ipset
+    - restart firewall v4
     - iptables-persistent
 
 - name: configure IPv4 firewall
@@ -85,6 +85,17 @@
     - restart firewall v4
     - iptables-persistent
 
+- name: configure IPv6 ipsets
+  template:
+    src: ipset.v6.j2
+    dest: "{{ firewall_ipset_v6 }}"
+    owner: root
+    group: root
+    mode: 0600
+  notify:
+    - restart firewall v6
+    - iptables-persistent
+
 - name: configure IPv6 firewall
   template:
     src: ip6tables.j2

roles/firewall/templates/ip6tables.j2

@@ -23,31 +23,16 @@
 -A LOG_DROP -p udp -m udp -m comment --comment "drop udp6" -j DROP
 -A LOG_DROP -m comment --comment "reject all inet6" -j REJECT --reject-with icmp6-adm-prohibited
 
-{% if "wireguard" in ansible_play_role_names %}
-{%   for name, conf in wireguard_interfaces.items() %}
--A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
-{%   endfor %}
-{%   for name, conf in wireguard_iptables.items() %}
-{%     if "input" in conf and conf.input %}
--A INPUT -i {{ name }} -j LOG_ACCEPT
-{%     endif %}
-{%     if "dns" in conf and conf.dns %}
--A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
--A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
-{%     endif %}
-{%   endfor %}
-{% endif %}
-
 {% if firewall_limit_ssh %}
 -N LIMIT_SSH
--A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
+-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v6 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
 -A LIMIT_SSH -m recent --set --name SSH --rsource
 {% if firewall_use_ulogd %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
 {% else %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
 {% endif %}
--A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff6 src
+-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v6 src
 -A LIMIT_SSH -j ACCEPT
 {% endif %}
 
@@ -63,6 +48,16 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+-N ACCEPT_DNS
+{% for ip in firewall_dns_whitelist | ipv6 %}
+-A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
+-A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
+{% endfor %}
+-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
+{% endif %}
+
 -A INPUT -i lo -m comment --comment "lo accept all inet6" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -72,13 +67,21 @@
 {% endif %}
 
 {% if firewall_ipset_mgmt | length %}
--A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v6 src -m comment --comment "accept mgmt ssh 22/tcp6" -j ACCEPT
+{% endif %}
+
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+-A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
+-A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
 {% endif %}
 
--A INPUT -m set --match-set block6 src -m comment --comment "drop block6" -j LOG_DROP
--A INPUT -m set --match-set gray6 src -m comment --comment "drop gray6" -j LOG_DROP
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid inet6" -j DROP
 
+{% if firewall_ipset_blacklist | length %}
+-A INPUT -m set --match-set mgmt_v6 src -m comment --comment "drop blacklist inet6" -j LOG_DROP
+{% endif %}
+
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 130 -m comment --comment "accept icmpv6 130" -j ACCEPT
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 131 -m comment --comment "accept icmpv6 131" -j ACCEPT
 -A INPUT -s fe80::/10 -p icmpv6 -m icmpv6 --icmpv6-type 132 -m comment --comment "accept icmpv6 132" -j ACCEPT
@@ -110,7 +113,7 @@
 -A INPUT -p icmpv6 -m icmpv6 --icmpv6-type 149 -m hl --hl-eq 255 -m comment --comment "accept icmpv6 149" -j ACCEPT
 
 {% if firewall_ipset_bogons | length %}
--A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v6 src,dst -m comment --comment "drop bogons inet6" -j LOG_DROP
 {% endif %}
 
 {% if firewall_limit_ssh %}
@@ -119,32 +122,6 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp6" -j ACCEPT
 {% endif %}
 
-{% if firewall_ipset_node_exporter is defined %}
--A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter6 src -m comment --comment "accept node_exporter 9100/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_blackbox_exporter is defined %}
--A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter6 src -m comment --comment "accept blackbox_exporter 9115/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_mtail is defined %}
--A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail6 src -m comment --comment "accept mtail 3903/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_syslog is defined %}
--A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog6 src -m comment --comment "accept syslog 514/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_influxdb is defined %}
--A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb6 src -m comment --comment "accept influxdb 8086/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_dns is defined %}
--A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/tcp6" -j LOG_ACCEPT
--A INPUT -p udp -m udp --dport 53 -m set --match-set dns6 src -m comment --comment "accept dns 53/udp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_loki is defined %}
--A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki6 src -m comment --comment "accept loki 3100/tcp6" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_promtail is defined %}
--A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail6 src -m comment --comment "accept promtail 9080/tcp6" -j LOG_ACCEPT
-{% endif %}
-
 {% if firewall_allowed_tcp_ports | length %}
 {% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp6" -j ACCEPT
@@ -175,15 +152,7 @@
 
 -A INPUT -m comment --comment "default drop inet6" -j LOG_DROP
 
-{% if "wireguard" in ansible_play_role_names %}
+-A FORWARD -m comment --comment "default forward drop inet6" -j LOG_DROP
-{%   for name, conf in wireguard_iptables.items() %}
-{%     if "forward" in conf and conf.forward %}
--A FORWARD -i {{ name }} -o eth0 -j ACCEPT
-{%      endif %}
-{%   endfor %}
-{% endif %}
--A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
--A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
 
 -A OUTPUT -m comment --comment "default output accept inet6" -j ACCEPT
 COMMIT

roles/firewall/templates/ipset.j2

@@ -1,48 +0,0 @@
-{% macro render_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
-create {{ name }} {{ type | default('hash:net') }} family {{ family }} counters {% if timeout %}timeout {{ timeout }}{% endif %} -exist
-flush {{ name }}
-{%   if ipset is iterable %}
-{%     for ip_or_net in ipset %}
-add {{ name }} {{ ip_or_net }}
-{%     endfor %}
-{%   endif %}
-{% endmacro %}
-
-{% macro render_dual_stack_ipset(ipset, name, type="hash:net", family="inet", timeout=None) %}
-{{ render_ipset(ipset | ipv4, name + "4", type=type, family=family, timeout=timeout) }}
-{{ render_ipset(ipset | ipv6, name + "6", type=type, family="inet6", timeout=timeout) }}
-{% endmacro %}
-
-{{ render_dual_stack_ipset([], 'block') }}
-{{ render_dual_stack_ipset([], 'gray', type="hash:ip", timeout=600) }}
-{{ render_dual_stack_ipset([], 'cooloff', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
-{% if firewall_ipset_mgmt is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_mgmt, 'mgmt') }}
-{% endif %}
-{% if firewall_ipset_bogons is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_bogons, 'bogons') }}
-{% endif %}
-{% if firewall_ipset_node_exporter is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_node_exporter, 'node_exporter') }}
-{% endif %}
-{% if firewall_ipset_blackbox_exporter is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter') }}
-{% endif %}
-{% if firewall_ipset_mtail is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_mtail, 'mtail') }}
-{% endif %}
-{% if firewall_ipset_syslog is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_syslog, 'syslog') }}
-{% endif %}
-{% if firewall_ipset_influxdb is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_influxdb, 'influxdb') }}
-{% endif %}
-{% if firewall_ipset_dns is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_dns, 'dns') }}
-{% endif %}
-{% if firewall_ipset_loki is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_loki, 'loki') }}
-{% endif %}
-{% if firewall_ipset_promtail is defined %}
-{{ render_dual_stack_ipset(firewall_ipset_promtail, 'promtail') }}
-{% endif %}

roles/firewall/templates/ipset.v4.j2

@@ -8,30 +8,10 @@ add {{ name }} {{ ip_or_net }}
 {% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt, 'mgmt4') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v4') }}
 
-{{ render_ipset([], 'blacklist4') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v4') }}
-{{ render_ipset([], 'graylist4', type="hash:ip", timeout=600) }}
 
-{{ render_ipset(firewall_ipset_bogons, 'bogons4') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v4') }}
 
-{{ render_ipset([], 'cooloff4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+{{ render_ipset([], 'cooloff_v4', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
-
-{% if firewall_ipset_node_exporter is defined %}
-{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter4') }}
-{% endif %}
-{% if firewall_ipset_blackbox_exporter is defined %}
-{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter4') }}
-{% endif %}
-{% if firewall_ipset_mtail is defined %}
-{{ render_ipset(firewall_ipset_mtail, 'mtail4') }}
-{% endif %}
-{% if firewall_ipset_syslog is defined %}
-{{ render_ipset(firewall_ipset_syslog, 'syslog4') }}
-{% endif %}
-{% if firewall_ipset_influxdb is defined %}
-{{ render_ipset(firewall_ipset_influxdb, 'influxdb4') }}
-{% endif %}
-{% if firewall_ipset_dns is defined %}
-{{ render_ipset(firewall_ipset_dns, 'dns4') }}
-{% endif %}

roles/firewall/templates/ipset.v6.j2

@@ -8,30 +8,10 @@ add {{ name }} {{ ip_or_net }}
 {% endif %}
 {% endmacro %}
 
-{{ render_ipset(firewall_ipset_mgmt, 'mgmt6') }}
+{{ render_ipset(firewall_ipset_mgmt, 'mgmt_v6') }}
 
-{{ render_ipset([], 'blacklist6') }}
+{{ render_ipset(firewall_ipset_blacklist, 'blacklist_v6') }}
-{{ render_ipset([], 'graylist6', type="hash:ip", timeout=600) }}
 
-{{ render_ipset(firewall_ipset_bogons, 'bogons6') }}
+{{ render_ipset(firewall_ipset_bogons, 'bogons_v6') }}
 
-{{ render_ipset([], 'cooloff6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
+{{ render_ipset([], 'cooloff_v6', type="hash:ip", timeout=firewall_ipset_cooloff_timeout) }}
-
-{% if firewall_ipset_node_exporter is defined %}
-{{ render_ipset(firewall_ipset_node_exporter, 'node_exporter6') }}
-{% endif %}
-{% if firewall_ipset_blackbox_exporter is defined %}
-{{ render_ipset(firewall_ipset_blackbox_exporter, 'blackbox_exporter6') }}
-{% endif %}
-{% if firewall_ipset_mtail is defined %}
-{{ render_ipset(firewall_ipset_mtail, 'mtail6') }}
-{% endif %}
-{% if firewall_ipset_syslog is defined %}
-{{ render_ipset(firewall_ipset_syslog, 'syslog6') }}
-{% endif %}
-{% if firewall_ipset_influxdb is defined %}
-{{ render_ipset(firewall_ipset_influxdb, 'influxdb6') }}
-{% endif %}
-{% if firewall_ipset_dns is defined %}
-{{ render_ipset(firewall_ipset_dns, 'dns6') }}
-{% endif %}

roles/firewall/templates/iptables.j2

@@ -23,31 +23,16 @@
 -A LOG_DROP -p udp -m udp -m comment --comment "drop udp" -j DROP
 -A LOG_DROP -m comment --comment "reject all" -j REJECT --reject-with icmp-admin-prohibited
 
-{% if "wireguard" in ansible_play_role_names %}
-{%   for name, conf in wireguard_interfaces.items() %}
--A INPUT -m udp -p udp --dport {{ conf.listen_port }} -m comment --comment "accept wireguard {{ conf.listen_port }}/udp" -j LOG_ACCEPT
-{%   endfor %}
-{%   for name, conf in wireguard_iptables.items() %}
-{%     if "input" in conf and conf.input %}
--A INPUT -i {{ name }} -j LOG_ACCEPT
-{%     endif %}
-{%     if "dns" in conf and conf.dns %}
--A INPUT -i {{ name }} -m tcp -p tcp --dport 53 -j LOG_ACCEPT
--A INPUT -i {{ name }} -m udp -p udp --dport 53 -j LOG_ACCEPT
-{%     endif %}
-{%   endfor %}
-{% endif %}
-
 {% if firewall_limit_ssh %}
 -N LIMIT_SSH
--A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
+-A LIMIT_SSH -p tcp -m tcp -m set --match-set cooloff_v4 src -m comment --comment "rate limit ssh 22/tcp" -j REJECT --reject-with tcp-reset
 -A LIMIT_SSH -m recent --set --name SSH --rsource
 {% if firewall_use_ulogd %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j NFLOG --nflog-prefix "[iptables SSH BRUTE] "
 {% else %}
 -A LIMIT_SSH -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -m limit --limit {{ firewall_log_limit }} --limit-burst {{ firewall_log_limit_burst }} -j LOG --log-prefix "[iptables SSH BRUTE] " --log-level info
 {% endif %}
--A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff4 src
+-A LIMIT_SSH -p tcp -m tcp -m recent --update --seconds {{ firewall_limit_ssh_seconds }} --hitcount {{ firewall_limit_ssh_hitcount }} --name SSH --rsource -j SET --add-set cooloff_v4 src
 -A LIMIT_SSH -j ACCEPT
 {% endif %}
 
@@ -63,6 +48,34 @@
 -A ICMP_FLOOD -j ACCEPT
 {% endif %}
 
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+-N ACCEPT_DNS
+{% for ip in firewall_dns_whitelist | ipv4 %}
+-A ACCEPT_DNS -m tcp -p tcp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/tcp" -j LOG_ACCEPT
+-A ACCEPT_DNS -m udp -p udp --dport 53 --source {{ ip }} -m comment --comment "accept {{ ip }} dns 53/udp" -j LOG_ACCEPT
+{% endfor %}
+-A ACCEPT_DNS -m comment --comment "ACCEPT_DNS default drop" -j LOG_DROP
+{% endif %}
+
+{% if firewall_influx_whitelist is defined and
+      firewall_influx_whitelist | length %}
+-N ACCEPT_INFLUX
+{% for ip in firewall_influx_whitelist | ipv4 %}
+-A ACCEPT_INFLUX -m tcp -p tcp --dport 8086 --source {{ ip }} -m comment --comment "accept {{ ip }} influxdb 8086/tcp" -j LOG_ACCEPT
+{% endfor %}
+-A ACCEPT_INFLUX -m comment --comment "ACCEPT_INFLUX default drop" -j LOG_DROP
+{% endif %}
+
+{% if firewall_syslog_whitelist is defined and
+      firewall_syslog_whitelist | length %}
+-N ACCEPT_SYSLOG
+{% for ip in firewall_syslog_whitelist | ipv4 %}
+-A ACCEPT_SYSLOG -m tcp -p tcp --dport 514 --source {{ ip }} -m comment --comment "accept {{ ip }} syslog 514/tcp" -j LOG_ACCEPT
+{% endfor %}
+-A ACCEPT_SYSLOG -m comment --comment "ACCEPT_SYSLOG default drop" -j LOG_DROP
+{% endif %}
+
 -A INPUT -i lo -m comment --comment "lo accept all" -j ACCEPT
 
 {% if firewall_ssh_whitelist | length %}
@@ -72,15 +85,33 @@
 {% endif %}
 
 {% if firewall_ipset_mgmt | length %}
--A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
+-A INPUT -p tcp -m tcp --dport 22 -m set --match-set mgmt_v4 src -m comment --comment "accept mgmt ssh 22/tcp" -j ACCEPT
+{% endif %}
+
+{% if firewall_dns_whitelist is defined and
+      firewall_dns_whitelist | length %}
+-A INPUT -m tcp -p tcp --dport 53 -m comment --comment "accept dns 53/tcp" -j ACCEPT_DNS
+-A INPUT -m udp -p udp --dport 53 -m comment --comment "accept dns 53/udp" -j ACCEPT_DNS
+{% endif %}
+
+{% if firewall_influx_whitelist is defined and
+      firewall_influx_whitelist | length %}
+-A INPUT -m tcp -p tcp --dport 8086 -m comment --comment "accept influx 8086/tcp" -j ACCEPT_INFLUX
+{% endif %}
+
+{% if firewall_syslog_whitelist is defined and
+      firewall_syslog_whitelist | length %}
+-A INPUT -m tcp -p tcp --dport 514 -m comment --comment "accept syslog 514/tcp" -j ACCEPT_SYSLOG
 {% endif %}
 
--A INPUT -m set --match-set block4 src -m comment --comment "drop block4" -j LOG_DROP
--A INPUT -m set --match-set gray4 src -m comment --comment "drop gray4" -j LOG_DROP
 -A INPUT -m state --state INVALID -m comment --comment "drop invalid" -j DROP
 
+{% if firewall_ipset_blacklist | length %}
+-A INPUT -m set --match-set mgmt_v4 src -m comment --comment "drop blacklist" -j LOG_DROP
+{% endif %}
+
 {% if firewall_ipset_bogons | length %}
--A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
+-A INPUT -i {{ firewall_bogon_interface }} -m set --match-set bogons_v4 src,dst -m comment --comment "drop bogons" -j LOG_DROP
 {% endif %}
 
 -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -m comment --comment "accept icmp destination-unreachable" -j ACCEPT
@@ -105,33 +136,6 @@
 -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m comment --comment "accept ssh 22/tcp" -j ACCEPT
 {% endif %}
 
-{% if firewall_ipset_node_exporter is defined %}
--A INPUT -p tcp -m tcp --dport 9100 -m set --match-set node_exporter4 src -m comment --comment "accept node_exporter 9100/tcp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_blackbox_exporter is defined %}
--A INPUT -p tcp -m tcp --dport 9115 -m set --match-set blackbox_exporter4 src -m comment --comment "accept blackbox_exporter 9115/tcp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_mtail is defined %}
--A INPUT -p tcp -m tcp --dport 3903 -m set --match-set mtail4 src -m comment --comment "accept mtail 3903/tcp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_syslog is defined %}
--A INPUT -p tcp -m tcp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/tcp" -j LOG_ACCEPT
--A INPUT -p udp -m udp --dport 514 -m set --match-set syslog4 src -m comment --comment "accept syslog 514/udp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_influxdb is defined %}
--A INPUT -p tcp -m tcp --dport 8086 -m set --match-set influxdb4 src -m comment --comment "accept influxdb 8086/tcp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_dns is defined %}
--A INPUT -p tcp -m tcp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/tcp" -j LOG_ACCEPT
--A INPUT -p udp -m udp --dport 53 -m set --match-set dns4 src -m comment --comment "accept dns 53/udp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_loki is defined %}
--A INPUT -p tcp -m tcp --dport 3100 -m set --match-set loki4 src -m comment --comment "accept loki 3100/tcp" -j LOG_ACCEPT
-{% endif %}
-{% if firewall_ipset_promtail is defined %}
--A INPUT -p tcp -m tcp --dport 9080 -m set --match-set promtail4 src -m comment --comment "accept promtail 9080/tcp" -j LOG_ACCEPT
-{% endif %}
-
 {% if firewall_allowed_tcp_ports | length %}
 {% for port in firewall_allowed_tcp_ports %}
 -A INPUT -p tcp -m tcp --dport {{ port }} -m comment --comment "accept {{ port }}/tcp" -j ACCEPT
@@ -162,14 +166,6 @@
 
 -A INPUT -m comment --comment "default drop" -j LOG_DROP
 
-{% if "wireguard" in ansible_play_role_names %}
-{%   for name, conf in wireguard_iptables.items() %}
-{%     if "forward" in conf and conf.forward %}
--A FORWARD -i {{ name }} -o eth0 -j ACCEPT
-{%      endif %}
-{%   endfor %}
-{% endif %}
--A FORWARD -m state --state RELATED,ESTABLISHED -m comment --comment "accept related/established" -j ACCEPT
 -A FORWARD -m comment --comment "default forward drop" -j LOG_DROP
 
 -A OUTPUT -m comment --comment "default output accept" -j ACCEPT
@@ -184,18 +180,4 @@ COMMIT
 {% endif %}
 COMMIT
 
-*nat
-:PREROUTING ACCEPT -
-:INPUT ACCEPT -
-:OUTPUT ACCEPT -
-:POSTROUTING ACCEPT -
-
-{% if "wireguard" in ansible_play_role_names %}
-{%   for name, conf in wireguard_iptables.items() %}
-{%     if "nat" in conf %}
--A POSTROUTING -o {{ conf.nat.out_iface }} -s {{ conf.nat.source }} -j MASQUERADE
-{%     endif %}
-{%   endfor %}
-{% endif %}
-COMMIT
 # vim: tw=0