iptables: Don't set empty defaults, check if var is defined

roles/iptables/defaults/main.yml

@@ -1,6 +1,3 @@
 ---
-
 firewall_in:
   - {proto: tcp, port: 22}
-
-firewall_raw: []

roles/iptables/templates/ip6tables.j2

@@ -5,9 +5,11 @@
 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 -A INPUT -p ipv6-icmp -j ACCEPT
 -A INPUT -i lo -j ACCEPT
+{% if firewall_raw6 is defined %}
 {%   for rule in firewall_raw6 %}
 {{ rule }}
 {%   endfor %}
+{% endif %}
 {% for rule in firewall_in %}
 {%   if rule.from is defined %}
 {%     for from in rule.from | ipv6 %}

roles/iptables/templates/iptables.j2

@@ -5,9 +5,11 @@
 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -i lo -j ACCEPT
+{% if firewall_raw is defined %}
 {%   for rule in firewall_raw %}
 {{ rule }}
 {%   endfor %}
+{% endif %}
 {% for rule in firewall_in %}
 {%   if rule.from is defined %}
 {%     for from in rule.from | ipv4 %}