data/templates/firewall/nftables-geoip-update.j2


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

#!/usr/sbin/nft -f

{% if ipv4_sets is vyos_defined %}
{%     for setname, ip_list in ipv4_sets.items() %}
flush set ip vyos_filter {{ setname }}
{%     endfor %}

table ip vyos_filter {
{%     for setname, ip_list in ipv4_sets.items() %}
    set {{ setname }} {
        type ipv4_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}

{% if ipv6_sets is vyos_defined %}
{%     for setname, ip_list in ipv6_sets.items() %}
flush set ip6 vyos_filter {{ setname }}
{%     endfor %}

table ip6 vyos_filter {
{%     for setname, ip_list in ipv6_sets.items() %}
    set {{ setname }} {
        type ipv6_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}


{% if ipv4_sets_policy is vyos_defined %}
{%     for setname, ip_list in ipv4_sets_policy.items() %}
flush set ip vyos_mangle {{ setname }}
{%     endfor %}

table ip vyos_mangle {
{%     for setname, ip_list in ipv4_sets_policy.items() %}
    set {{ setname }} {
        type ipv4_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}

{% if ipv6_sets_policy is vyos_defined %}
{%     for setname, ip_list in ipv6_sets_policy.items() %}
flush set ip6 vyos_mangle {{ setname }}
{%     endfor %}

table ip6 vyos_mangle {
{%     for setname, ip_list in ipv6_sets_policy.items() %}
    set {{ setname }} {
        type ipv6_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}