diff --git a/templates/custom.firewall-restore.j2 b/templates/custom.firewall-restore.j2
index a91d261..c07b055 100644
--- a/templates/custom.firewall-restore.j2
+++ b/templates/custom.firewall-restore.j2
@@ -2,7 +2,6 @@
 
 {{ ansible_managed | comment }}
 
-{% set iptables_enemy = namespace(ipv4=1, ipv6=1) %}
 ipset restore -! < {{ whitelist_ipset_config_file }}
 
 # IPv4
@@ -11,32 +10,16 @@ iptables -N f2b-sshd
 iptables -A f2b-sshd -j RETURN
 iptables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
 
-
 iptables -N enemy_input
 iptables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
 iptables -N DOCKER-USER
 iptables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
-{% for port in whitelist_public_tcp_port %}
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-{% endfor %}
-{% for port in whitelist_public_udp_port %}
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-{% endfor %}
-
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-{% for port in whitelist_public_tcp_port %}
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p tcp ! --dport {{ port }}  -j DROP
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-{% endfor %}
-{% for port in whitelist_public_udp_port %}
-iptables -I enemy_input {{ iptables_enemy.ipv4 }} -p udp ! --dport {{ port }}  -j DROP
-{% set iptables_enemy.ipv4 = iptables_enemy.ipv4 + 1 %}
-{% endfor %}
+iptables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }}  -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 3 -m set --match-set {{ whitelist_ip4_name }} src -j ACCEPT
+iptables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }}  -j DROP
+iptables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }}  -j DROP
 
 # IPv6
 
@@ -44,29 +27,13 @@ ip6tables -N f2b-sshd
 ip6tables -A f2b-sshd -j RETURN
 ip6tables -I INPUT 1 -p tcp -m multiport --dports {{ whitelist_ssh_port }} -j f2b-sshd
 
-
 ip6tables -N enemy_input
 ip6tables -I INPUT 1 -i {{ whitelist_interface }} -j enemy_input
 ip6tables -N DOCKER-USER
 ip6tables -I DOCKER-USER 1 -i {{ whitelist_interface }} -j enemy_input
-{% for port in whitelist_public_tcp_port %}
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-{% endfor %}
-{% for port in whitelist_public_udp_port %}
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-{% endfor %}
-
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -m state --state RELATED,ESTABLISHED -j ACCEPT
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-{% for port in whitelist_public_tcp_port %}
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p tcp ! --dport {{ port }}  -j DROP
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-{% endfor %}
-{% for port in whitelist_public_udp_port %}
-ip6tables -I enemy_input {{ iptables_enemy.ipv6 }} -p udp ! --dport {{ port }}  -j DROP
-{% set iptables_enemy.ipv6 = iptables_enemy.ipv6 + 1 %}
-{% endfor %}
+ip6tables -I enemy_input 1 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 2 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }}  -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 3 -m set --match-set {{ whitelist_ip6_name }} src -j ACCEPT
+ip6tables -I enemy_input 4 -m state --state RELATED,ESTABLISHED -j ACCEPT
+ip6tables -I enemy_input 5 -p tcp -m multiport ! --dports {{ whitelist_public_tcp_port|join(',') }}  -j DROP
+ip6tables -I enemy_input 6 -p udp -m multiport ! --dports {{ whitelist_public_udp_port|join(',') }}  -j DROP