# vars: firewall_tcp_ports, firewall_udp_ports (optional), firewall_forward (optional, пропускать транзитный трафик)
- name: Install nftables
  ansible.builtin.apt:
    name: nftables
    state: present

- name: Write nftables config
  ansible.builtin.template:
    src: templates/nftables.conf.j2
    dest: /etc/nftables.conf
    mode: "0755"
    validate: /usr/sbin/nft -c -f %s

- name: Apply nftables
  ansible.builtin.systemd_service:
    name: nftables
    enabled: true
    state: restarted