base / iptables: fix protocol, use creates for commands

iptables -p is expecting all, not any.
And create a file to track when we have made the ipset.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

roles/base/tasks/main.yml

@@ -150,8 +150,7 @@
 
 - name: setup builder ipset if this is a new install
   command: /usr/sbin/ipset create osbuildapi hash:ip
-  ignore_errors: true
-  changed_when: false
+  creates: /etc/sysconfig/ipset-osbuildapi
   when: "'osbuild' in group_names"
   tags:
     - base
@@ -171,8 +170,7 @@
 
 - name: setup blocklist ipset if this is a new install
   command: /usr/sbin/ipset create blocklist hash:ip
-  ignore_errors: true
-  changed_when: false
+  creates: /etc/sysconfig/blocklist
   when: "'iad2' not in inventory_hostname or ( datacenter == 'iad2' and external == 'true')"
   tags:
     - base

roles/base/templates/iptables/iptables

@@ -16,7 +16,7 @@
 
 # if the host is external, block some ips
 {% if datacenter != 'iad2' or ( datacenter == 'iad2' and hostvars[inventory_hostname].external == 'true' ) %}
--A INPUT -p any -m set --match-set blocklist src -j REJECT
+-A INPUT -p all -m set --match-set blocklist src -j REJECT
 {% endif %}
 
 # allow ssh - always