Role ipt-server: allow IPv6-only overrides of shared variables; migrate nd, oolm-shop, web-01, web0.

Shared variables (and fw_ext_interfaces / fw_local_interfaces) can now be
overridden for IPv6 via <name>_v6. extract-fw-host-vars.py emits these
overrides when the IPv4 and IPv6 configs differ, instead of a warning.

Add host_vars for nd.warenform.de, oolm-shop.oopen.de, web-01.oopen.de
and web0.warenform.de (fw_manage_config: true).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extract-fw-host-vars.py

@@ -543,21 +543,33 @@ def build_host_vars(parsed_iface_v4, parsed_iface_v6, parsed_main_v4, parsed_mai
         if v and v != DEFAULTS.get(ansible_var, ""):
             result[ansible_var] = v
 
+    # IPv6 interface lists that differ from IPv4 -> fw_*_interfaces_v6 override
+    for prefix, ansible_var, v4_list in [("ext_if_", "fw_ext_interfaces", fw_ext_interfaces),
+                                         ("local_if_", "fw_local_interfaces", fw_local_interfaces)]:
+        v6_list = extract_list(parsed_iface_v6, prefix)
+        if v6_list != v4_list:
+            result[f"{ansible_var}_v6"] = v6_list
+
     # --- Shared main variables (read from ipv4, fall back to ipv6) ---
+    # If IPv4 and IPv6 differ, the IPv6 value goes into <ansible_var>_v6.
+    def to_value(raw):
+        raw = normalize_value(raw)
+        return coerce_bool(raw) if raw.lower() in ("true", "false") else raw
+
     for bash_var, ansible_var in MAIN_SHARED.items():
         raw_v4 = parsed_main_v4.get(bash_var)
         raw_v6 = parsed_main_v6.get(bash_var)
-        if raw_v4 is not None and raw_v6 is not None \
-                and normalize_value(raw_v4) != normalize_value(raw_v6):
-            warnings.append(f"  # {ansible_var}: IPv4 '{raw_v4}' != IPv6 '{raw_v6}' — IPv4 value used")
         raw = raw_v4 if raw_v4 is not None else raw_v6
         if raw is None:
             continue
-        raw = normalize_value(raw)
+        v = to_value(raw)
-        v = coerce_bool(raw) if raw.lower() in ("true", "false") else raw
         default = DEFAULTS.get(ansible_var)
         if v != default:
             result[ansible_var] = v
+        if raw_v4 is not None and raw_v6 is not None:
+            v6 = to_value(raw_v6)
+            if v6 != v:
+                result[f"{ansible_var}_v6"] = v6
 
     # --- IPv4-only main variables ---
     for bash_var, ansible_var in MAIN_V4_ONLY.items():
@@ -681,13 +693,20 @@ def render_yaml(hostname, host_vars, all_warnings):
         ("Special", ["fw_create_traffic_counter", "fw_create_iperf_rules"]),
     ]
 
+    # IPv6-only overrides of shared variables follow their base variable
+    sections = [(name, [x for k in keys for x in (k, f"{k}_v6")
+                        if x == k or x not in keys])
+                for name, keys in sections]
+
     emitted = set()
     for section_name, keys in sections:
         section_lines = []
         for k in keys:
             if k in host_vars:
                 v = host_vars[k]
-                if isinstance(v, list):
+                if isinstance(v, list) and not v:
+                    section_lines.append(f"{k}: []")
+                elif isinstance(v, list):
                     section_lines.append(f"{k}:")
                     for item in v:
                         section_lines.append(f"  - \"{item}\"")
@@ -707,7 +726,9 @@ def render_yaml(hostname, host_vars, all_warnings):
     if remaining:
         lines.append("# --- Other")
         for k, v in remaining.items():
-            if isinstance(v, list):
+            if isinstance(v, list) and not v:
+                lines.append(f"{k}: []")
+            elif isinstance(v, list):
                 lines.append(f"{k}:")
                 for item in v:
                     lines.append(f"  - \"{item}\"")

host_vars/nd.warenform.de/nd-ipt-server.yml

@@ -0,0 +1,43 @@
+---
+# ipt-firewall configuration for nd.warenform.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+  - "eth1"
+fw_ext_ips_v4:
+  - "83.223.86.50"
+  - "83.223.86.53"
+fw_ext_ips_v6:
+  - "2a01:30:0:13:2f4:75ff:fe1e:376f 2a01:30:0:505:2f4:75ff:fe1e:376f"
+  - "2a01:30:0:13:201:82ff:fedf:737a 2a01:30:0:505:201:82ff:fedf:737a"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Access control IPv4
+fw_allow_ext_service_v4: "xkat.catalogue.librinet.de:8097:tcp wf.oopen.de:9998:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip $ext_2_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- VPN / WireGuard
+fw_wireguard_server_ips: $ext_ips
+
+# --- FTP
+fw_ftp_server_ips: $ext_2_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+
+# --- Protection / limits
+fw_per_IP_connection_limit: 501
+fw_limit_new_tcp_connections_per_seconds_per_source_IP: false

host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml

@@ -0,0 +1,47 @@
+---
+# ipt-firewall configuration for oolm-shop.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "83.223.86.124"
+fw_ext_ips_v6:
+  - "2a01:30:0:505:263:20ff:feaa:7783 2a01:30:0:13:263:20ff:feaa:7783"
+fw_local_interfaces:
+  - "eth1"
+fw_local_interfaces_v6: []
+fw_local_ips_v4:
+  - "192.168.3.124"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Outgoing / interfaces
+fw_unprotected_ifs: eth1
+fw_unprotected_ifs_v6: ""
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- FTP
+fw_ftp_server_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+
+# --- Protection / limits
+fw_limit_connections_per_source_IP: false
+fw_limit_connections_per_source_IP_v6: true
+fw_per_IP_connection_limit: 2048
+fw_per_IP_connection_limit_v6: 1024
+fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
+fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6: true

host_vars/web-01.oopen.de/web-01-ipt-server.yml

@@ -0,0 +1,33 @@
+---
+# ipt-firewall configuration for web-01.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "162.55.82.78"
+fw_ext_ips_v6:
+  - "2a01:4f8:271:1266::78"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_smtpd_ips: $ext_1_ip
+fw_mail_server_ips: $ext_1_ip
+fw_mail_server_ips_v6: ""
+fw_mail_client_ips: $ext_1_ip
+
+# --- FTP
+fw_ftp_server_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14

host_vars/web0.warenform.de/web0-ipt-server.yml

@@ -0,0 +1,33 @@
+---
+# ipt-firewall configuration for web0.warenform.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "83.223.85.164"
+fw_ext_ips_v6:
+  - "2a01:30:0:13:286:96ff:fe4a:6eee 2a01:30:0:505:286:96ff:fe4a:6eee"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Access control IPv4
+fw_allow_ext_service_v4: "wf.oopen.de:9998:tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+fw_set_max_new_http_conn_per_ip_per_second: false
+fw_set_max_concurrent_http_conn_per_ip: false
+fw_set_max_new_http_conn_per_second: false
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14

roles/ipt-server/README.md

@@ -158,6 +158,19 @@ fw_lxc_guest_ips_v6:
   - "fd00::11"
 ```
 
+### Abweichende Werte nur für IPv6
+
+Variablen ohne `_v4`/`_v6`-Suffix gelten für beide Firewalls. Jede davon
+lässt sich für IPv6 mit `<name>_v6` überschreiben (ebenso
+`fw_ext_interfaces_v6` / `fw_local_interfaces_v6`). `extract-fw-host-vars.py`
+erzeugt diese Overrides automatisch, wenn IPv4- und IPv6-Konfiguration
+voneinander abweichen.
+
+```yaml
+fw_mail_server_ips: $ext_1_ip
+fw_mail_server_ips_v6: ""        # Mail-Ports nur über IPv4
+```
+
 ---
 
 ## Firewall-Skripte aktualisieren

roles/ipt-server/templates/etc/ipt-firewall/interfaces_ipv6.conf.j2

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 # {{ ansible_managed }}
+{# IPv6 interface lists default to the IPv4 ones; override with fw_*_interfaces_v6. #}
+{% set ext_interfaces_v6 = fw_ext_interfaces_v6 | default(fw_ext_interfaces) %}
+{% set local_interfaces_v6 = fw_local_interfaces_v6 | default(fw_local_interfaces) %}
 
 
 # -------------
@@ -8,11 +11,11 @@
 
 # - External interface(s)
 #
-ext_if_1="{{ fw_ext_interfaces[0] if fw_ext_interfaces | length >= 1 else '' }}"
+ext_if_1="{{ ext_interfaces_v6[0] if ext_interfaces_v6 | length >= 1 else '' }}"
-ext_if_2="{{ fw_ext_interfaces[1] if fw_ext_interfaces | length >= 2 else '' }}"
+ext_if_2="{{ ext_interfaces_v6[1] if ext_interfaces_v6 | length >= 2 else '' }}"
-ext_if_3="{{ fw_ext_interfaces[2] if fw_ext_interfaces | length >= 3 else '' }}"
+ext_if_3="{{ ext_interfaces_v6[2] if ext_interfaces_v6 | length >= 3 else '' }}"
 
-ext_ifs="{{ fw_ext_interfaces | join(' ') }}"
+ext_ifs="{{ ext_interfaces_v6 | join(' ') }}"
 
 
 # - VPN Interfaces
@@ -26,11 +29,11 @@ wg_ifs="{{ fw_wg_ifs }}"
 
 
 # - Local Interfaces
-local_if_1="{{ fw_local_interfaces[0] if fw_local_interfaces | length >= 1 else '' }}"
+local_if_1="{{ local_interfaces_v6[0] if local_interfaces_v6 | length >= 1 else '' }}"
-local_if_2="{{ fw_local_interfaces[1] if fw_local_interfaces | length >= 2 else '' }}"
+local_if_2="{{ local_interfaces_v6[1] if local_interfaces_v6 | length >= 2 else '' }}"
-local_if_3="{{ fw_local_interfaces[2] if fw_local_interfaces | length >= 3 else '' }}"
+local_if_3="{{ local_interfaces_v6[2] if local_interfaces_v6 | length >= 3 else '' }}"
 
-local_ifs="{{ fw_local_interfaces | join(' ') }}"
+local_ifs="{{ local_interfaces_v6 | join(' ') }}"
 
 
 # -------------

roles/ipt-server/templates/etc/ipt-firewall/main_ipv6.conf.j2

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 # {{ ansible_managed }}
+{#
+  Variables shared between IPv4 and IPv6 can be overridden for IPv6 only
+  by defining <name>_v6 (e.g. fw_mail_server_ips_v6: "").
+#}
 
 
 ## ----------------------------------------------------------------
@@ -11,32 +15,32 @@
 # --- Bridged / LXC traffic
 # -------------
 
-do_not_firewall_bridged_traffic={{ fw_do_not_firewall_bridged_traffic | lower }}
+do_not_firewall_bridged_traffic={{ (fw_do_not_firewall_bridged_traffic_v6 | default(fw_do_not_firewall_bridged_traffic)) | lower }}
-do_not_firewall_lx_guest_systems={{ fw_do_not_firewall_lx_guest_systems | lower }}
+do_not_firewall_lx_guest_systems={{ (fw_do_not_firewall_lx_guest_systems_v6 | default(fw_do_not_firewall_lx_guest_systems)) | lower }}
 
 
 # -------------
 # --- Drop ICMP / MNDP / mDNS
 # -------------
 
-drop_icmp={{ fw_drop_icmp | lower }}
+drop_icmp={{ (fw_drop_icmp_v6 | default(fw_drop_icmp)) | lower }}
-drop_mndp={{ fw_drop_mndp | lower }}
+drop_mndp={{ (fw_drop_mndp_v6 | default(fw_drop_mndp)) | lower }}
-drop_mdns={{ fw_drop_mdns | lower }}
+drop_mdns={{ (fw_drop_mdns_v6 | default(fw_drop_mdns)) | lower }}
 
 
 # -------------
 # --- Outgoing traffic
 # -------------
 
-allow_all_outgoing_traffic={{ fw_allow_all_outgoing_traffic | lower }}
+allow_all_outgoing_traffic={{ (fw_allow_all_outgoing_traffic_v6 | default(fw_allow_all_outgoing_traffic)) | lower }}
 
 
 # -------------
 # --- Interface policy
 # -------------
 
-blocked_ifs="{{ fw_blocked_ifs }}"
+blocked_ifs="{{ (fw_blocked_ifs_v6 | default(fw_blocked_ifs)) }}"
-unprotected_ifs="{{ fw_unprotected_ifs }}"
+unprotected_ifs="{{ (fw_unprotected_ifs_v6 | default(fw_unprotected_ifs)) }}"
 
 
 # -------------
@@ -75,34 +79,34 @@ allow_local_service_from_networks="{{ fw_allow_local_service_from_networks_v6 }}
 # --- Services: VPN / WireGuard
 # -------------
 
-vpn_server_ips="{{ fw_vpn_server_ips }}"
+vpn_server_ips="{{ (fw_vpn_server_ips_v6 | default(fw_vpn_server_ips)) }}"
-forward_vpn_server_ips="{{ fw_forward_vpn_server_ips }}"
+forward_vpn_server_ips="{{ (fw_forward_vpn_server_ips_v6 | default(fw_forward_vpn_server_ips)) }}"
-vpn_ports="{{ fw_vpn_ports }}"
+vpn_ports="{{ (fw_vpn_ports_v6 | default(fw_vpn_ports)) }}"
 
-wireguard_server_ips="{{ fw_wireguard_server_ips }}"
+wireguard_server_ips="{{ (fw_wireguard_server_ips_v6 | default(fw_wireguard_server_ips)) }}"
-forward_wireguard_server_ips="{{ fw_forward_wireguard_server_ips }}"
+forward_wireguard_server_ips="{{ (fw_forward_wireguard_server_ips_v6 | default(fw_forward_wireguard_server_ips)) }}"
-wireguard_server_ports="{{ fw_wireguard_server_ports }}"
+wireguard_server_ports="{{ (fw_wireguard_server_ports_v6 | default(fw_wireguard_server_ports)) }}"
-wireguard_out_ports="{{ fw_wireguard_out_ports }}"
+wireguard_out_ports="{{ (fw_wireguard_out_ports_v6 | default(fw_wireguard_out_ports)) }}"
 
 
 # -------------
 # --- Services: NTP
 # -------------
 
-local_ntp_service={{ fw_local_ntp_service | lower }}
+local_ntp_service={{ (fw_local_ntp_service_v6 | default(fw_local_ntp_service)) | lower }}
-ntp_port="{{ fw_ntp_port }}"
+ntp_port="{{ (fw_ntp_port_v6 | default(fw_ntp_port)) }}"
-ntp_allowed_net="{{ fw_ntp_allowed_net }}"
+ntp_allowed_net="{{ (fw_ntp_allowed_net_v6 | default(fw_ntp_allowed_net)) }}"
 
 
 # -------------
 # --- Services: DNS
 # -------------
 
-dns_server_ips="{{ fw_dns_server_ips }}"
+dns_server_ips="{{ (fw_dns_server_ips_v6 | default(fw_dns_server_ips)) }}"
-forward_dns_server_ips="{{ fw_forward_dns_server_ips }}"
+forward_dns_server_ips="{{ (fw_forward_dns_server_ips_v6 | default(fw_forward_dns_server_ips)) }}"
 
-local_resolver_service={{ fw_local_resolver_service | lower }}
+local_resolver_service={{ (fw_local_resolver_service_v6 | default(fw_local_resolver_service)) | lower }}
-resolver_port="{{ fw_resolver_port }}"
+resolver_port="{{ (fw_resolver_port_v6 | default(fw_resolver_port)) }}"
 # resolver_allowed_networks="2001:678:a40:3000::/64"
 resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}"
 
@@ -111,31 +115,31 @@ resolver_allowed_networks="{{ fw_resolver_allowed_networks_v6 }}"
 # --- Services: SSH
 # -------------
 
-ssh_server_ips="{{ fw_ssh_server_ips }}"
+ssh_server_ips="{{ (fw_ssh_server_ips_v6 | default(fw_ssh_server_ips)) }}"
-forward_ssh_server_ips="{{ fw_forward_ssh_server_ips }}"
+forward_ssh_server_ips="{{ (fw_forward_ssh_server_ips_v6 | default(fw_forward_ssh_server_ips)) }}"
-ssh_ports="{{ fw_ssh_ports }}"
+ssh_ports="{{ (fw_ssh_ports_v6 | default(fw_ssh_ports)) }}"
 
 
 # -------------
 # --- Services: HTTP(S)
 # -------------
 
-http_server_ips="{{ fw_http_server_ips }}"
+http_server_ips="{{ (fw_http_server_ips_v6 | default(fw_http_server_ips)) }}"
-forward_http_server_ips="{{ fw_forward_http_server_ips }}"
+forward_http_server_ips="{{ (fw_forward_http_server_ips_v6 | default(fw_forward_http_server_ips)) }}"
-http_ports="{{ fw_http_ports }}"
+http_ports="{{ (fw_http_ports_v6 | default(fw_http_ports)) }}"
 
-log_cgi_traffic_out={{ fw_log_cgi_traffic_out | lower }}
+log_cgi_traffic_out={{ (fw_log_cgi_traffic_out_v6 | default(fw_log_cgi_traffic_out)) | lower }}
-cgi_script_users="{{ fw_cgi_script_users }}"
+cgi_script_users="{{ (fw_cgi_script_users_v6 | default(fw_cgi_script_users)) }}"
 
 # Restrictions on HTTP(S) connections to counteract attacks
-set_max_new_http_conn_per_ip_per_second={{ fw_set_max_new_http_conn_per_ip_per_second | lower }}
+set_max_new_http_conn_per_ip_per_second={{ (fw_set_max_new_http_conn_per_ip_per_second_v6 | default(fw_set_max_new_http_conn_per_ip_per_second)) | lower }}
-max_http_new_conn_per_ip_per_second="{{ fw_max_http_new_conn_per_ip_per_second }}"
+max_http_new_conn_per_ip_per_second="{{ (fw_max_http_new_conn_per_ip_per_second_v6 | default(fw_max_http_new_conn_per_ip_per_second)) }}"
 
-set_max_concurrent_http_conn_per_ip={{ fw_set_max_concurrent_http_conn_per_ip | lower }}
+set_max_concurrent_http_conn_per_ip={{ (fw_set_max_concurrent_http_conn_per_ip_v6 | default(fw_set_max_concurrent_http_conn_per_ip)) | lower }}
-max_concurrent_http_conn_per_ip="{{ fw_max_concurrent_http_conn_per_ip }}"
+max_concurrent_http_conn_per_ip="{{ (fw_max_concurrent_http_conn_per_ip_v6 | default(fw_max_concurrent_http_conn_per_ip)) }}"
 
-set_max_new_http_conn_per_second={{ fw_set_max_new_http_conn_per_second | lower }}
+set_max_new_http_conn_per_second={{ (fw_set_max_new_http_conn_per_second_v6 | default(fw_set_max_new_http_conn_per_second)) | lower }}
-max_new_http_conn_per_second="{{ fw_max_new_http_conn_per_second }}"
+max_new_http_conn_per_second="{{ (fw_max_new_http_conn_per_second_v6 | default(fw_max_new_http_conn_per_second)) }}"
 
 # Clamp the advertised MSS of incoming HTTPS SYN packets
 throttle_tcp6_mss_for_https={{ fw_throttle_tcp6_mss_for_https | lower }}
@@ -146,31 +150,31 @@ tcp6_mss_for_https_val="{{ fw_tcp6_mss_for_https_val }}"
 # --- Services: Mattermost
 # -------------
 
-mm_server_ips="{{ fw_mm_server_ips }}"
+mm_server_ips="{{ (fw_mm_server_ips_v6 | default(fw_mm_server_ips)) }}"
-forward_mm_server_ips="{{ fw_forward_mm_server_ips }}"
+forward_mm_server_ips="{{ (fw_forward_mm_server_ips_v6 | default(fw_forward_mm_server_ips)) }}"
-mm_udp_ports_in="{{ fw_mm_udp_ports_in }}"
+mm_udp_ports_in="{{ (fw_mm_udp_ports_in_v6 | default(fw_mm_udp_ports_in)) }}"
-mm_tcp_ports_in="{{ fw_mm_tcp_ports_in }}"
+mm_tcp_ports_in="{{ (fw_mm_tcp_ports_in_v6 | default(fw_mm_tcp_ports_in)) }}"
-mm_udp_ports_out="{{ fw_mm_udp_ports_out }}"
+mm_udp_ports_out="{{ (fw_mm_udp_ports_out_v6 | default(fw_mm_udp_ports_out)) }}"
 
 
 # -------------
 # --- Services: Mail (SMTP / IMAP / POP)
 # -------------
 
-smtpd_ips="{{ fw_smtpd_ips }}"
+smtpd_ips="{{ (fw_smtpd_ips_v6 | default(fw_smtpd_ips)) }}"
-forward_smtpd_ips="{{ fw_forward_smtpd_ips }}"
+forward_smtpd_ips="{{ (fw_forward_smtpd_ips_v6 | default(fw_forward_smtpd_ips)) }}"
-smtpd_additional_listen_ports="{{ fw_smtpd_additional_listen_ports }}"
+smtpd_additional_listen_ports="{{ (fw_smtpd_additional_listen_ports_v6 | default(fw_smtpd_additional_listen_ports)) }}"
-smtpd_additional_outgoung_ports="{{ fw_smtpd_additional_outgoing_ports }}"
+smtpd_additional_outgoung_ports="{{ (fw_smtpd_additional_outgoing_ports_v6 | default(fw_smtpd_additional_outgoing_ports)) }}"
 
-mail_server_ips="{{ fw_mail_server_ips }}"
+mail_server_ips="{{ (fw_mail_server_ips_v6 | default(fw_mail_server_ips)) }}"
-forward_mail_server_ips="{{ fw_forward_mail_server_ips }}"
+forward_mail_server_ips="{{ (fw_forward_mail_server_ips_v6 | default(fw_forward_mail_server_ips)) }}"
-mail_user_ports="{{ fw_mail_user_ports }}"
+mail_user_ports="{{ (fw_mail_user_ports_v6 | default(fw_mail_user_ports)) }}"
 
-mail_client_ips="{{ fw_mail_client_ips }}"
+mail_client_ips="{{ (fw_mail_client_ips_v6 | default(fw_mail_client_ips)) }}"
-forward_mail_client_ips="{{ fw_forward_mail_client_ips }}"
+forward_mail_client_ips="{{ (fw_forward_mail_client_ips_v6 | default(fw_forward_mail_client_ips)) }}"
 
-dovecot_auth_service={{ fw_dovecot_auth_service | lower }}
+dovecot_auth_service={{ (fw_dovecot_auth_service_v6 | default(fw_dovecot_auth_service)) | lower }}
-dovecot_auth_port="{{ fw_dovecot_auth_port }}"
+dovecot_auth_port="{{ (fw_dovecot_auth_port_v6 | default(fw_dovecot_auth_port)) }}"
 # dovecot_auth_allowed_networks="2001:678:a40:3000::/64 2a01:30:0:13:2f7:50ff:fed2:cef7"
 dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}"
 
@@ -179,19 +183,19 @@ dovecot_auth_allowed_networks="{{ fw_dovecot_auth_allowed_networks_v6 }}"
 # --- Services: FTP
 # -------------
 
-ftp_server_ips="{{ fw_ftp_server_ips }}"
+ftp_server_ips="{{ (fw_ftp_server_ips_v6 | default(fw_ftp_server_ips)) }}"
-forward_ftp_server_ips="{{ fw_forward_ftp_server_ips }}"
+forward_ftp_server_ips="{{ (fw_forward_ftp_server_ips_v6 | default(fw_forward_ftp_server_ips)) }}"
-ftp_passive_port_range="{{ fw_ftp_passive_port_range }}"
+ftp_passive_port_range="{{ (fw_ftp_passive_port_range_v6 | default(fw_ftp_passive_port_range)) }}"
 
 
 # -------------
 # --- Services: XMPP (Jabber / Prosody)
 # -------------
 
-xmpp_server_ips="{{ fw_xmpp_server_ips }}"
+xmpp_server_ips="{{ (fw_xmpp_server_ips_v6 | default(fw_xmpp_server_ips)) }}"
-forward_xmpp_server_ips="{{ fw_forward_xmpp_server_ips }}"
+forward_xmpp_server_ips="{{ (fw_forward_xmpp_server_ips_v6 | default(fw_forward_xmpp_server_ips)) }}"
-xmmp_tcp_in_ports="{{ fw_xmmp_tcp_in_ports }}"
+xmmp_tcp_in_ports="{{ (fw_xmmp_tcp_in_ports_v6 | default(fw_xmmp_tcp_in_ports)) }}"
-xmmp_tcp_out_ports="{{ fw_xmmp_tcp_out_ports }}"
+xmmp_tcp_out_ports="{{ (fw_xmmp_tcp_out_ports_v6 | default(fw_xmmp_tcp_out_ports)) }}"
 # xmmp_remote_out_services="2a01:4f8:221:3b4e::247,44444"
 xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}"
 
@@ -200,31 +204,31 @@ xmmp_remote_out_services="{{ fw_xmmp_remote_out_services_v6 }}"
 # --- Services: Mumble
 # -------------
 
-mumble_server_ips="{{ fw_mumble_server_ips }}"
+mumble_server_ips="{{ (fw_mumble_server_ips_v6 | default(fw_mumble_server_ips)) }}"
-forward_mumble_server_ips="{{ fw_forward_mumble_server_ips }}"
+forward_mumble_server_ips="{{ (fw_forward_mumble_server_ips_v6 | default(fw_forward_mumble_server_ips)) }}"
-mumble_ports="{{ fw_mumble_ports }}"
+mumble_ports="{{ (fw_mumble_ports_v6 | default(fw_mumble_ports)) }}"
 
 
 # -------------
 # --- Services: Jitsi / Jibri
 # -------------
 
-jitsi_server_ips="{{ fw_jitsi_server_ips }}"
+jitsi_server_ips="{{ (fw_jitsi_server_ips_v6 | default(fw_jitsi_server_ips)) }}"
-forward_jitsi_server_ips="{{ fw_forward_jitsi_server_ips }}"
+forward_jitsi_server_ips="{{ (fw_forward_jitsi_server_ips_v6 | default(fw_forward_jitsi_server_ips)) }}"
-jitsi_tcp_ports="{{ fw_jitsi_tcp_ports }}"
+jitsi_tcp_ports="{{ (fw_jitsi_tcp_ports_v6 | default(fw_jitsi_tcp_ports)) }}"
-jitsi_udp_port_range="{{ fw_jitsi_udp_port_range }}"
+jitsi_udp_port_range="{{ (fw_jitsi_udp_port_range_v6 | default(fw_jitsi_udp_port_range)) }}"
-jitsi_tcp_ports_out="{{ fw_jitsi_tcp_ports_out }}"
+jitsi_tcp_ports_out="{{ (fw_jitsi_tcp_ports_out_v6 | default(fw_jitsi_tcp_ports_out)) }}"
-jitsi_udp_ports_out="{{ fw_jitsi_udp_ports_out }}"
+jitsi_udp_ports_out="{{ (fw_jitsi_udp_ports_out_v6 | default(fw_jitsi_udp_ports_out)) }}"
-jitsi_dovecot_auth={{ fw_jitsi_dovecot_auth | lower }}
+jitsi_dovecot_auth={{ (fw_jitsi_dovecot_auth_v6 | default(fw_jitsi_dovecot_auth)) | lower }}
-jitsi_dovecot_host="{{ fw_jitsi_dovecot_host }}"
+jitsi_dovecot_host="{{ (fw_jitsi_dovecot_host_v6 | default(fw_jitsi_dovecot_host)) }}"
 jitsi_dovecot_port="{{ fw_jitsi_dovecot_port }}"
-jitsi_jibri_remote_auth={{ fw_jitsi_jibri_remote_auth | lower }}
+jitsi_jibri_remote_auth={{ (fw_jitsi_jibri_remote_auth_v6 | default(fw_jitsi_jibri_remote_auth)) | lower }}
-jitsi_jibri_remote_ips="{{ fw_jitsi_jibri_remote_ips }}"
+jitsi_jibri_remote_ips="{{ (fw_jitsi_jibri_remote_ips_v6 | default(fw_jitsi_jibri_remote_ips)) }}"
 jitsi_jibri_remote_auth_port="{{ fw_jitsi_jibri_remote_auth_port }}"
 
-jibri_server_ips="{{ fw_jibri_server_ips }}"
+jibri_server_ips="{{ (fw_jibri_server_ips_v6 | default(fw_jibri_server_ips)) }}"
-forward_jibri_server_ips="{{ fw_forward_jibri_server_ips }}"
+forward_jibri_server_ips="{{ (fw_forward_jibri_server_ips_v6 | default(fw_forward_jibri_server_ips)) }}"
-jibri_remote_jitsi_server="{{ fw_jibri_remote_jitsi_server }}"
+jibri_remote_jitsi_server="{{ (fw_jibri_remote_jitsi_server_v6 | default(fw_jibri_remote_jitsi_server)) }}"
 jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}"
 
 
@@ -232,69 +236,69 @@ jibri_remote_auth_port="{{ fw_jibri_remote_auth_port }}"
 # --- Services: TURN / STUN (Nextcloud Talk)
 # -------------
 
-nc_turn_server_ips="{{ fw_nc_turn_server_ips }}"
+nc_turn_server_ips="{{ (fw_nc_turn_server_ips_v6 | default(fw_nc_turn_server_ips)) }}"
-forward_nc_turn_server_ips="{{ fw_forward_nc_turn_server_ips }}"
+forward_nc_turn_server_ips="{{ (fw_forward_nc_turn_server_ips_v6 | default(fw_forward_nc_turn_server_ips)) }}"
-nc_turn_ports="{{ fw_nc_turn_ports }}"
+nc_turn_ports="{{ (fw_nc_turn_ports_v6 | default(fw_nc_turn_ports)) }}"
-nc_turn_udp_ports="{{ fw_nc_turn_udp_ports }}"
+nc_turn_udp_ports="{{ (fw_nc_turn_udp_ports_v6 | default(fw_nc_turn_udp_ports)) }}"
 
 
 # -------------
 # --- Services: TFTP (not yet implemented)
 # -------------
 
-tftp_server_ips="{{ fw_tftp_server_ips }}"
+tftp_server_ips="{{ (fw_tftp_server_ips_v6 | default(fw_tftp_server_ips)) }}"
 
 
 # -------------
 # --- Services: Prometheus
 # -------------
 
-prometheus_local_server_ips="{{ fw_prometheus_local_server_ips }}"
+prometheus_local_server_ips="{{ (fw_prometheus_local_server_ips_v6 | default(fw_prometheus_local_server_ips)) }}"
 prometheus_remote_client_ports="{{ fw_prometheus_remote_client_ports }}"
 
-prometheus_local_client_ips="{{ fw_prometheus_local_client_ips }}"
+prometheus_local_client_ips="{{ (fw_prometheus_local_client_ips_v6 | default(fw_prometheus_local_client_ips)) }}"
 prometheus_local_client_ports="{{ fw_prometheus_local_client_ports }}"
-prometheus_remote_server_ips="{{ fw_prometheus_remote_server_ips }}"
+prometheus_remote_server_ips="{{ (fw_prometheus_remote_server_ips_v6 | default(fw_prometheus_remote_server_ips)) }}"
 
 
 # -------------
 # --- Services: Munin
 # -------------
 
-munin_server_ips="{{ fw_munin_server_ips }}"
+munin_server_ips="{{ (fw_munin_server_ips_v6 | default(fw_munin_server_ips)) }}"
-forward_munin_server_ips="{{ fw_forward_munin_server_ips }}"
+forward_munin_server_ips="{{ (fw_forward_munin_server_ips_v6 | default(fw_forward_munin_server_ips)) }}"
-munin_remote_port="{{ fw_munin_remote_port }}"
+munin_remote_port="{{ (fw_munin_remote_port_v6 | default(fw_munin_remote_port)) }}"
 
 munin_remote_ip="{{ munin_remote_ipv6 }}"
-munin_local_port="{{ fw_munin_local_port }}"
+munin_local_port="{{ (fw_munin_local_port_v6 | default(fw_munin_local_port)) }}"
 
 
 # -------------
 # --- Services: Xymon (not yet implemented)
 # -------------
 
-xymon_server_ips="{{ fw_xymon_server_ips }}"
+xymon_server_ips="{{ (fw_xymon_server_ips_v6 | default(fw_xymon_server_ips)) }}"
-local_xymon_client={{ fw_local_xymon_client | lower }}
+local_xymon_client={{ (fw_local_xymon_client_v6 | default(fw_local_xymon_client)) | lower }}
-xymon_port="{{ fw_xymon_port }}"
+xymon_port="{{ (fw_xymon_port_v6 | default(fw_xymon_port)) }}"
 
 
 # -------------
 # --- Protocols out: Rsync
 # -------------
 
-rsync_out_ips="{{ fw_rsync_out_ips }}"
+rsync_out_ips="{{ (fw_rsync_out_ips_v6 | default(fw_rsync_out_ips)) }}"
-forward_rsync_out_ips="{{ fw_forward_rsync_out_ips }}"
+forward_rsync_out_ips="{{ (fw_forward_rsync_out_ips_v6 | default(fw_forward_rsync_out_ips)) }}"
-rsync_ports="{{ fw_rsync_ports }}"
+rsync_ports="{{ (fw_rsync_ports_v6 | default(fw_rsync_ports)) }}"
 
 
 # -------------
 # --- Special ports (OUT)
 # -------------
 
-tcp_out_ports="{{ fw_tcp_out_ports }}"
+tcp_out_ports="{{ (fw_tcp_out_ports_v6 | default(fw_tcp_out_ports)) }}"
-forward_tcp_out_ports="{{ fw_forward_tcp_out_ports }}"
+forward_tcp_out_ports="{{ (fw_forward_tcp_out_ports_v6 | default(fw_forward_tcp_out_ports)) }}"
-udp_out_ports="{{ fw_udp_out_ports }}"
+udp_out_ports="{{ (fw_udp_out_ports_v6 | default(fw_udp_out_ports)) }}"
-forward_udp_out_ports="{{ fw_forward_udp_out_ports }}"
+forward_udp_out_ports="{{ (fw_forward_udp_out_ports_v6 | default(fw_forward_udp_out_ports)) }}"
 
 
 # =============
@@ -315,36 +319,36 @@ blocked_ips="{{ fw_blocked_ips_v6 }}"
 # Prefix length for entries in ban_ipv6.list given without mask
 ban_ipv6_mask="{{ fw_ban_ipv6_mask }}"
 
-block_tcp_ports="{{ fw_block_tcp_ports }}"
+block_tcp_ports="{{ (fw_block_tcp_ports_v6 | default(fw_block_tcp_ports)) }}"
-block_udp_ports="{{ fw_block_udp_ports }}"
+block_udp_ports="{{ (fw_block_udp_ports_v6 | default(fw_block_udp_ports)) }}"
 
 
 # -------------
 # --- Special / Counters
 # -------------
 
-create_traffic_counter={{ fw_create_traffic_counter | lower }}
+create_traffic_counter={{ (fw_create_traffic_counter_v6 | default(fw_create_traffic_counter)) | lower }}
-create_iperf_rules={{ fw_create_iperf_rules | lower }}
+create_iperf_rules={{ (fw_create_iperf_rules_v6 | default(fw_create_iperf_rules)) | lower }}
 
 
 # -------------
 # --- Protection
 # -------------
 
-protection_against_syn_flooding={{ fw_protection_against_syn_flooding | lower }}
+protection_against_syn_flooding={{ (fw_protection_against_syn_flooding_v6 | default(fw_protection_against_syn_flooding)) | lower }}
-protection_against_port_scanning={{ fw_protection_against_port_scanning | lower }}
+protection_against_port_scanning={{ (fw_protection_against_port_scanning_v6 | default(fw_protection_against_port_scanning)) | lower }}
-protection_against_ssh_brute_force_attacks={{ fw_protection_against_ssh_brute_force_attacks | lower }}
+protection_against_ssh_brute_force_attacks={{ (fw_protection_against_ssh_brute_force_attacks_v6 | default(fw_protection_against_ssh_brute_force_attacks)) | lower }}
 
 
 # -------------
 # --- Connection limits
 # -------------
 
-limit_connections_per_source_IP={{ fw_limit_connections_per_source_IP | lower }}
+limit_connections_per_source_IP={{ (fw_limit_connections_per_source_IP_v6 | default(fw_limit_connections_per_source_IP)) | lower }}
-per_IP_connection_limit={{ fw_per_IP_connection_limit }}
+per_IP_connection_limit={{ (fw_per_IP_connection_limit_v6 | default(fw_per_IP_connection_limit)) }}
 
-limit_new_tcp_connections_per_seconds_per_source_IP={{ fw_limit_new_tcp_connections_per_seconds_per_source_IP | lower }}
+limit_new_tcp_connections_per_seconds_per_source_IP={{ (fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6 | default(fw_limit_new_tcp_connections_per_seconds_per_source_IP)) | lower }}
-limit_new_tcp_connections_per_seconds_ports="{{ fw_limit_new_tcp_connections_per_seconds_ports }}"
+limit_new_tcp_connections_per_seconds_ports="{{ (fw_limit_new_tcp_connections_per_seconds_ports_v6 | default(fw_limit_new_tcp_connections_per_seconds_ports)) }}"
 
 
 # -------------