From 365cbfd8dee4032ff9ef647d36a59ed9d0115493 Mon Sep 17 00:00:00 2001
From: OldTyT <nezlobin118@gmail.com>
Date: Sat, 13 Jun 2026 19:50:09 +0300
Subject: [PATCH] chore: added banlist ipset list

---
 defaults/main.yml                    |  4 ++++
 templates/custom.firewall-restore.j2 | 26 ++++++++++++++------------
 templates/ipset.j2                   |  8 ++++++++
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/defaults/main.yml b/defaults/main.yml
index 0fa61eb..d96ffd0 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,4 +1,8 @@
 ---
+banlist_ip4_name: "banlist"
+banlist_ip6_name: "banlist6"
+banlist_ip4: []
+banlist_ip6: []
 whitelist_ip4: []
 whitelist_ip6: []
 whitelist_interface: "eth0"
diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2
index 940b53e..784b5c3 100644
--- a/templates/custom.firewall-restore.j2
+++ b/templates/custom.firewall-restore.j2
@@ -14,12 +14,13 @@ iptables -N enemy_input
 iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
 iptables -N DOCKER-USER
 iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
-iptables -I enemy_input 1 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-iptables -I enemy_input 2 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-iptables -I enemy_input 3 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
-iptables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
+iptables -I enemy_input 1 -m set --match-set {{ banlist_ip4_name }} src -j DROP
+iptables -I enemy_input 2 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 3 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 4 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 5 -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -I enemy_input 6 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
+iptables -I enemy_input 7 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
 
 iptables -I enemy_input -p icmp --icmp-type echo-request -j DROP
 
@@ -33,11 +34,12 @@ ip6tables -N enemy_input
 ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
 ip6tables -N DOCKER-USER
 ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
-ip6tables -I enemy_input 1 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-ip6tables -I enemy_input 2 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
-ip6tables -I enemy_input 5 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
-ip6tables -I enemy_input 6 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
+ip6tables -I enemy_input 1 -m set --match-set {{ banlist_ip6_name }} src -j DROP
+ip6tables -I enemy_input 2 -p tcp -m set --match-set {{ whitelist_ports_tcp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 3 -p udp -m set --match-set {{ whitelist_ports_udp }} dst -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 4 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 5 -m state --state RELATED,ESTABLISHED -j ACCEPT
+ip6tables -I enemy_input 6 -p tcp -m set ! --match-set {{ whitelist_ports_tcp }} dst -j DROP
+ip6tables -I enemy_input 7 -p udp -m set ! --match-set {{ whitelist_ports_udp }} dst -j DROP
 
 ip6tables -I enemy_input -p icmpv6 --icmpv6-type echo-request -j DROP
diff --git a/templates/ipset.j2 b/templates/ipset.j2
index b034c60..3930545 100644
--- a/templates/ipset.j2
+++ b/templates/ipset.j2
@@ -1,4 +1,12 @@
 flush
+create {{ banlist_ip4_name }} hash:net maxelem 65536
+{% for ban_ip4 in banlist_ip4 %}
+add {{ banlist_ip4_name }} {{ ban_ip4 }}
+{% endfor %}
+create {{ banlist_ip6_name }} hash:ip family inet6
+{% for ban_ip6 in banlist_ip6 %}
+add {{ banlist_ip6_name }} {{ ban_ip6 }}
+{% endfor %}
 create {{ whitelist_ip4_name }} hash:net maxelem 65536
 {% for white_ip4 in whitelist_ip4 %}
 add {{ whitelist_ip4_name }} {{ white_ip4 }}