defaults/main.yml

@@ -2,58 +2,9 @@
 iptables__state: install
 iptables__drop_by_default: false
 iptables__allow_output_ifaces: []
-iptables__ssh_port: 22
+iptables__v4_filter_prepend: null
-iptables__ssh_ifaces: []
+iptables__v4_filter_append: null
-
+iptables__v4_nat: null
-#############
+iptables__v6_filter_prepend: null
-# NAT table #
+iptables__v6_filter_append: null
-#############
+iptables__v6_nat: null
-
-iptables__nat_v4:  null
-iptables__nat_v6:  null
-iptables__nat_all: null
-
-################
-# Filter table #
-################
-
-iptables__filter_prepend0_v4:  null
-iptables__filter_prepend0_v6:  null
-iptables__filter_prepend0_all: null
-iptables__filter_prepend1_v4:  null
-iptables__filter_prepend1_v6:  null
-iptables__filter_prepend1_all: null
-iptables__filter_prepend2_v4:  null
-iptables__filter_prepend2_v6:  null
-iptables__filter_prepend2_all: null
-
-iptables__filter_append0_v4:   null
-iptables__filter_append0_v6:   null
-iptables__filter_append0_all:  null
-iptables__filter_append1_v4:   null
-iptables__filter_append1_v6:   null
-iptables__filter_append1_all:  null
-iptables__filter_append2_v4:   null
-iptables__filter_append2_v6:   null
-iptables__filter_append2_all:  null
-
-iptables__filter_ssh_before_v4:   null
-iptables__filter_ssh_before_v6:   null
-iptables__filter_ssh_before_all:  null
-iptables__filter_ssh_after_v4:    null
-iptables__filter_ssh_after_v6:    null
-iptables__filter_ssh_after_all:   null
-
-iptables__filter_loop_before_v4:  null
-iptables__filter_loop_before_v6:  null
-iptables__filter_loop_before_all: null
-iptables__filter_loop_after_v4:   null
-iptables__filter_loop_after_v6:   null
-iptables__filter_loop_after_all:  null
-
-iptables__filter_out_before_v4:   null
-iptables__filter_out_before_v6:   null
-iptables__filter_out_before_all:  null
-iptables__filter_out_after_v4:    null
-iptables__filter_out_after_v6:    null
-iptables__filter_out_after_all:   null

handlers/main.yml

@@ -1,6 +1,6 @@
 ---
-- name: iptables | Load iptables rules for IPv4
+- name: Load iptables rules for IPv4
   shell: 'cat {{ iptables__conf_ipv4 }} | iptables-restore'
 
-- name: iptables | Load iptables rules for IPv6
+- name: Load iptables rules for IPv6
   shell: 'cat {{ iptables__conf_ipv6 }} | ip6tables-restore'

meta/main.yml

@@ -11,18 +11,14 @@ galaxy_info:
 
   galaxy_tags:
     - iptables
-    - firewall
-    - networking
 
   platforms:
     - name: Debian
       versions:
         - stretch  # Debian 9 Stretch
         - buster   # Debian 10 Buster
-        - bullseye # Debian 11 Bullseye
     - name: Ubuntu
       versions:
         - xenial  # Ubuntu 16.04 LTS Xenial Xerus
         - bionic  # Ubuntu 18.04 LTS Bionic Beaver
         - focal   # Ubuntu 20.04 LTS Focal Fossa
-        - jammy   # Ubuntu 22.04 LTS Jammy Jellyfish

tasks/install.yml

@@ -12,19 +12,19 @@
     group: root
 
 - name: Install iptables rules for IPv4
-  notify: iptables | Load iptables rules for IPv4
   template:
     src: templates/rules.v4
     dest: '{{ iptables__conf_ipv4 }}'
     mode: 'u=rw,go=r'
     owner: root
     group: root
+  notify: Load iptables rules for IPv4
 
 - name: Install iptables rules for IPv6
-  notify: iptables | Load iptables rules for IPv6
   template:
     src: templates/rules.v6
     dest: '{{ iptables__conf_ipv6 }}'
     mode: 'u=rw,go=r'
     owner: root
     group: root
+  notify: Load iptables rules for IPv6

templates/rules.v4

@@ -1,75 +1,35 @@
-################################################################################
+#####
 *nat
-################################################################################
+#####
 
 :PREROUTING  ACCEPT [0:0]
 :INPUT       ACCEPT [0:0]
 :OUTPUT      ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 
-# Remove all rules from all chains.
+# Remove all rules from all chains,
+# delete all user-defined chains.
 -F
-# Delete all user-defined chains.
 -X
 
-{{ iptables__nat_v4 }}
+{{ iptables__v4_nat }}
-{{ iptables__nat_all }}
 
 COMMIT
 
-
+########
-
-################################################################################
 *filter
-################################################################################
+########
 
 :INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 
-# Remove all rules from all chains.
+# Remove all rules from all chains,
+# delete all user-defined chains.
 -F
-# Delete all user-defined chains.
 -X
 
-##########
+{{ iptables__v4_filter_prepend }}
-# Custom #
-##########
-
-{{ iptables__filter_prepend0_v6 }}
-{{ iptables__filter_prepend0_all }}
-{{ iptables__filter_prepend1_v6 }}
-{{ iptables__filter_prepend1_all }}
-{{ iptables__filter_prepend2_v6 }}
-{{ iptables__filter_prepend2_all }}
-
-#######
-# SSH #
-#######
-
-{{ iptables__filter_ssh_before_v6 }}
-{{ iptables__filter_ssh_before_all }}
-
-# Allow incoming SSH.
-{% if iptables__ssh_ifaces %}
-{% for iface in iptables__ssh_ifaces %}
--A INPUT  -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
-{% endfor %}
-{% else %}
--A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
-{% endif %}
-
-{{ iptables__filter_ssh_after_v6 }}
-{{ iptables__filter_ssh_after_all }}
-
-############
-# Loopback #
-############
-
-{{ iptables__filter_loop_before_v6 }}
-{{ iptables__filter_loop_before_all }}
 
 # Allow all loopback (lo) traffic and reject anything
 # to localhost that does not originate from lo.
@@ -77,16 +37,6 @@ COMMIT
 -A INPUT ! -i lo -s 127.0.0.0/8 -j REJECT
 -A OUTPUT  -o lo                -j ACCEPT
 
-{{ iptables__filter_loop_after_v6 }}
-{{ iptables__filter_loop_after_all }}
-
-############
-# Outgoing #
-############
-
-{{ iptables__filter_out_before_v6 }}
-{{ iptables__filter_out_before_all }}
-
 # Allow all outgoing traffic.
 {% if iptables__allow_output_ifaces %}
 {% for iface in iptables__allow_output_ifaces %}
@@ -98,13 +48,6 @@ COMMIT
 -A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 {% endif %}
 
-{{ iptables__filter_out_after_v6 }}
-{{ iptables__filter_out_after_all }}
-
-########
-# ICMP #
-########
-
 # Allow some important ICMP.
 -A INPUT  -p icmp --icmp-type echo-request         -j ACCEPT
 -A OUTPUT -p icmp --icmp-type echo-request         -j ACCEPT
@@ -119,15 +62,10 @@ COMMIT
 -A INPUT  -p icmp -j DROP
 -A OUTPUT -p icmp -j DROP
 
-##########
+# Allow incoming SSH.
-# Custom #
+-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-##########
+-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 
-{{ iptables__filter_append0_v6 }}
+{{ iptables__v4_filter_append }}
-{{ iptables__filter_append0_all }}
-{{ iptables__filter_append1_v6 }}
-{{ iptables__filter_append1_all }}
-{{ iptables__filter_append2_v6 }}
-{{ iptables__filter_append2_all }}
 
 COMMIT

templates/rules.v6

@@ -1,75 +1,35 @@
-################################################################################
+#####
 *nat
-################################################################################
+#####
 
 :PREROUTING  ACCEPT [0:0]
 :INPUT       ACCEPT [0:0]
 :OUTPUT      ACCEPT [0:0]
 :POSTROUTING ACCEPT [0:0]
 
-# Remove all rules from all chains.
+# Remove all rules from all chains,
+# delete all user-defined chains.
 -F
-# Delete all user-defined chains.
 -X
 
-{{ iptables__nat_v6 }}
+{{ iptables__v6_nat }}
-{{ iptables__nat_all }}
 
 COMMIT
 
-
+########
-
-################################################################################
 *filter
-################################################################################
+########
 
 :INPUT   {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT  {{ 'DROP' if iptables__drop_by_default else 'ACCEPT' }} [0:0]
 
-# Remove all rules from all chains.
+# Remove all rules from all chains,
+# delete all user-defined chains.
 -F
-# Delete all user-defined chains.
 -X
 
-##########
+{{ iptables__v6_filter_prepend }}
-# Custom #
-##########
-
-{{ iptables__filter_prepend0_v4 }}
-{{ iptables__filter_prepend0_all }}
-{{ iptables__filter_prepend1_v4 }}
-{{ iptables__filter_prepend1_all }}
-{{ iptables__filter_prepend2_v4 }}
-{{ iptables__filter_prepend2_all }}
-
-#######
-# SSH #
-#######
-
-{{ iptables__filter_ssh_before_v4 }}
-{{ iptables__filter_ssh_before_all }}
-
-# Allow incoming SSH.
-{% if iptables__ssh_ifaces %}
-{% for iface in iptables__ssh_ifaces %}
--A INPUT  -i {{ iface }} -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -o {{ iface }} -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
-{% endfor %}
-{% else %}
--A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
--A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
-{% endif %}
-
-{{ iptables__filter_ssh_after_v4 }}
-{{ iptables__filter_ssh_after_all }}
-
-############
-# Loopback #
-############
-
-{{ iptables__filter_loop_before_v4 }}
-{{ iptables__filter_loop_before_all }}
 
 # Allow all loopback (lo) traffic and reject anything
 # to localhost that does not originate from lo.
@@ -77,16 +37,6 @@ COMMIT
 -A INPUT ! -i lo -s ::/128 -j REJECT
 -A OUTPUT  -o lo           -j ACCEPT
 
-{{ iptables__filter_loop_after_v4 }}
-{{ iptables__filter_loop_after_all }}
-
-############
-# Outgoing #
-############
-
-{{ iptables__filter_out_before_v4 }}
-{{ iptables__filter_out_before_all }}
-
 # Allow all outgoing traffic.
 {% if iptables__allow_output_ifaces %}
 {% for iface in iptables__allow_output_ifaces %}
@@ -98,13 +48,6 @@ COMMIT
 -A INPUT  -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 {% endif %}
 
-{{ iptables__filter_out_after_v4 }}
-{{ iptables__filter_out_after_all }}
-
-########
-# ICMP #
-########
-
 # Allow some important ICMP.
 -A INPUT  -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
 -A OUTPUT -p icmpv6 --icmpv6-type echo-request   -j ACCEPT
@@ -130,15 +73,10 @@ COMMIT
 -A INPUT  -p icmpv6 -j DROP
 -A OUTPUT -p icmpv6 -j DROP
 
-##########
+# Allow incoming SSH.
-# Custom #
+-A INPUT  -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-##########
+-A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED     -j ACCEPT
 
-{{ iptables__filter_append0_v4 }}
+{{ iptables__v6_filter_append }}
-{{ iptables__filter_append0_all }}
-{{ iptables__filter_append1_v4 }}
-{{ iptables__filter_append1_all }}
-{{ iptables__filter_append2_v4 }}
-{{ iptables__filter_append2_all }}
 
 COMMIT