A quick and dirty script to generate a large series of UFW rules based on IP ranges, formatted as Ansible variables for use with weareinteractive.ufw, also dumps out a set of bare UFW rules for manual application.

pypi-ufw-rules.sh

#!/bin/bash
#
# A simple script to generate Ansible role weareinteractive.ufw rules for Pypi.org CDN egress
# https://api.fastly.com/public-ip-list
#
# 2021-11-30 Kodiak Firesmith <kfiresmith@whoi.edu>
#
ruleset="23.235.32.0/20 43.249.72.0/22 103.244.50.0/24 103.245.222.0/23 103.245.224.0/24 104.156.80.0/20 140.248.64.0/18 140.248.128.0/17 146.75.0.0/17 151.101.0.0/16 157.52.64.0/18 167.82.0.0/17 167.82.128.0/20 167.82.160.0/20 167.82.224.0/20 172.111.64.0/18 185.31.16.0/22 199.27.72.0/21 199.232.0.0/16"

ports="80,443"

num=1

for target in $ruleset; do
cat <<EOF
  - rule: allow
    direction: out
    proto: tcp
    to_port: '$ports'
    to_ip: '$target'
    comment: 'Fastly CDN for Pypi.org $num'
EOF
num=$((num + 1))
done

num=1
for target in $ruleset; do
  echo "ufw allow out to $target port $ports proto tcp comment 'Fastly CDN for Pypi.org $num'"
  num=$((num + 1))
done