chore: remove old unused bits

  when: "ipv4_enabled"

# deploy ipv6 iptable rules

- name: "firewall - deploy ipv6 rules"

  ansible.builtin.copy:

    dest: "/etc/ip6tables/rules-save"

    mode: "0600"

    owner: "root"

    group: "root"

    content: |

      *filter

      :INPUT DROP [0:0]

      :FORWARD DROP [0:0]

      :OUTPUT ACCEPT [0:0]

      # Allow established/related

      -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

      -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Allow loopback

      -A INPUT -i lo -j ACCEPT

      # Allow LAN management access

      -A INPUT -i {{ lan_interface }} -j ACCEPT

      # Allow ICMPv6 (required for NDP/RA)

      -A INPUT -p ipv6-icmp -j ACCEPT

      -A FORWARD -p ipv6-icmp -j ACCEPT

      # Allow forwarding from LAN to anywhere

      -A FORWARD -i {{ lan_interface }} -o {{ wan_interface }} -j ACCEPT

      COMMIT

  notify: "restart ip6tables"

  when: "ipv6_enabled"

# remove iptables rules when disabled

- name: "firewall - remove ipv4 rules"

  ansible.builtin.file:

    path: "/etc/iptables/rules-save"

    state: "absent"

  notify: "restart iptables"

  when: "not ipv4_enabled"

# remove ip6tables rules when disabled

- name: "firewall - remove ipv6 rules"

  ansible.builtin.file:

    path: "/etc/ip6tables/rules-save"

    state: "absent"

  notify: "restart ip6tables"

  when: "not ipv6_enabled"

# load nf_conntrack module

- name: "firewall - load nf_conntrack module"

  community.general.modprobe:

    name: "nf_conntrack"

    state: "present"

  when: "ipv4_enabled or ipv6_enabled"

# configure nf_conntrack hashsize

- name: "firewall - configure nf_conntrack hashsize"

    mode: "0644"

    owner: "root"

    group: "root"

  when: "ipv4_enabled or ipv6_enabled"

# load nf_conntrack at boot

- name: "firewall - load nf_conntrack at boot"

    mode: "0644"

    owner: "root"

    group: "root"

  when: "ipv4_enabled or ipv6_enabled"

# set nf_conntrack hashsize at runtime

- name: "firewall - set nf_conntrack hashsize runtime"

  ansible.builtin.shell:

    cmd: "echo 16384 > /sys/module/nf_conntrack/parameters/hashsize"

  changed_when: false

  when: "ipv4_enabled or ipv6_enabled"

# configure nf_conntrack sysctl settings

- name: "firewall - configure conntrack sysctl settings"

      value: "3600"

    - name: "net.netfilter.nf_conntrack_generic_timeout"

      value: "120"

  when: "ipv4_enabled or ipv6_enabled"