{% set ferm__tpl_protocol = [] %}
{% if item.protocol is defined %}
{%   if item.protocol is string %}
{%     set _ = ferm__tpl_protocol.append(item.protocol) %}
{%   else %}
{%     for element in item.protocol %}
{%       set _ = ferm__tpl_protocol.append(element) %}
{%     endfor %}
{%   endif %}
{% elif item.protocols is defined %}
{%   if item.protocols is string %}
{%     set _ = ferm__tpl_protocol.append(item.protocols) %}
{%   else %}
{%     for element in item.protocols %}
{%       set _ = ferm__tpl_protocol.append(element) %}
{%     endfor %}
{%   endif %}
{% endif %}
{% set ferm__tpl_state = item.default_state | default('enabled') %}
{% if item.disabled is defined %}
{%   set ferm__tpl_state = 'enabled' %}
{%   if item.disabled is string %}
{%     if item.disabled | bool %}
{%       set ferm__tpl_state = 'disabled' %}
{%     endif %}
{%   else %}
{%     if item.disabled %}
{%       set ferm__tpl_state = 'disabled' %}
{%     endif %}
{%   endif %}
{% elif item.enabled is defined %}
{%   set ferm__tpl_state = 'disabled' %}
{%   if item.enabled is string %}
{%     if item.enabled | bool %}
{%       set ferm__tpl_state = 'enabled' %}
{%     endif %}
{%   else %}
{%     if item.enabled %}
{%       set ferm__tpl_state = 'enabled' %}
{%     endif %}
{%   endif %}
{% else %}
{%   set ferm__tpl_state = 'enabled' %}
{% endif %}
# {{ ansible_managed }}

{% if item.jump is undefined or not item.jump %}
# Accept new connections{% if item.saddr|d() %} from specified IP addresses{% endif %}{% if item.dport|d() %} on {{ item.dport | join(',') }} port{% endif %}
{% else %}
# Jump to specified chain
{% endif %}
{#

List of parameters:

Optional:
  item.dport		list of destination ports to configure
  item.protocol(s)	list of protocols to configure (tcp, udp)
  item.saddr		list of source addresses to accept
  item.accept_any	accept connections from any IP address if True
  item.disabled		if True, disable the rule (can be used to toggle rule via variable)
  item.enabled		if True, enable the rule (can be used to toggle rule via variable)
  item.include          include custom file or command output
  item.jump		jump tp specified chain

#}

{% if ferm__tpl_state == 'enabled' %}
{% if ferm__tpl_protocol or item.dport|d() %}protocol ({{ (ferm__tpl_protocol if ferm__tpl_protocol else ['tcp']) | join(' ') }}){% endif %}{% if item.dport|d() %} dport ({{ item.dport | join(' ') }}){% endif %}{% if ferm__tpl_protocol or item.dport|d() %} {% endif %}{
{% if item.saddr is defined and item.saddr %}
	@def $ITEMS = ( @ipfilter( ({{ item.saddr | unique | join(" ") }}) ) );
	@if @ne($ITEMS,"") {
		saddr $ITEMS ACCEPT;
	}
{% else %}
{% if item.accept_any is defined and item.accept_any | bool %}
	ACCEPT;
{% elif item.include is defined and item.include %}
	@include "{{ item.include }}";
{% elif item.jump is defined and item.jump %}
	jump "{{ item.jump }}";
{% else %}
	# Connections from any IP address not allowed
{% endif %}
{% endif %}
}
{% else %}
# dport_accept rule has been disabled by a variable
{% endif %}

