host_firewall: FireHOL level1 as its own set firehol_v4 next to Spamhaus, daily updater and firewall.firehol opt-out

host_firewall/defaults/main.yml

@@ -54,12 +54,17 @@ firewall:
     # Lets the kernel log the nft log statements of container network
     # namespaces (LXC guests) into the host kernel log.
     all_netns: false
-    # Shared by the Spamhaus drop (fw-spamhaus-in: ) and reject (fw-spamhaus-out: ) chains, one limit each.
+    # Shared by the Spamhaus (fw-spamhaus-in: , fw-spamhaus-out: ) and FireHOL (fw-firehol-in: , fw-firehol-out: ) chains, one limit each.
     spamhaus_rate: "6/minute burst 10 packets"
   # Spamhaus DROP, DROPv6 and ASN-DROP: traffic from the listed networks drops
   # (input, forward), traffic to them is rejected (output, forward). The sets
   # are refreshed daily by nft-host-spamhaus.
   spamhaus: true
+  # FireHOL level1 (IPv4): treated like the Spamhaus lists, with the prefixes
+  # fw-firehol-in: and fw-firehol-out: and the same log limit. Entries in
+  # private or reserved space and ones holding an address of the host are left
+  # out. Refreshed daily by nft-host-firehol.
+  firehol: true
   # Reject outbound TCP 25; the mail group turns it off.
   block_smtp_out: true
   # EU-27 plus CH, NO, GB, IS, LI (ipdeny country codes). Empty leaves the geo