114 files changed, 1914 insertions, 1919 deletions

diff --git a/data/templates/accel-ppp/chap-secrets.config_dict.tmpl b/data/templates/accel-ppp/chap-secrets.config_dict.j2
index d4e8bb2aa..51e66d57c 100644
--- a/data/templates/accel-ppp/chap-secrets.config_dict.tmpl
+++ b/data/templates/accel-ppp/chap-secrets.config_dict.j2
@@ -1,10 +1,10 @@
 # username  server  password  acceptable local IP addresses   shaper
 {% if authentication.local_users.username is vyos_defined %}
-{%   for user, user_config in authentication.local_users.username.items() if user_config.disabled is not vyos_defined %}
-{%     if user_config.rate_limit is vyos_defined %}
+{%     for user, user_config in authentication.local_users.username.items() if user_config.disabled is not vyos_defined %}
+{%         if user_config.rate_limit is vyos_defined %}
 {{ "%-12s" | format(user) }} * {{ "%-16s" | format(user_config.password) }} {{ "%-16s" | format(user_config.static_ip) }} {{ user_config.rate_limit.download }}/{{ user_config.rate_limit.upload }}
-{%     else %}
+{%         else %}
 {{ "%-12s" | format(user) }} * {{ "%-16s" | format(user_config.password) }} {{ "%-16s" | format(user_config.static_ip) }}
-{%     endif %}
-{%   endfor %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/accel-ppp/chap-secrets.ipoe.tmpl b/data/templates/accel-ppp/chap-secrets.ipoe.j2
index 1df878fcf..a1430ec22 100644
--- a/data/templates/accel-ppp/chap-secrets.ipoe.tmpl
+++ b/data/templates/accel-ppp/chap-secrets.ipoe.j2
@@ -1,18 +1,18 @@
 # username  server  password  acceptable local IP addresses   shaper
 {% for interface in auth_interfaces %}
-{% for mac in interface.mac %}
-{% if mac.rate_upload and mac.rate_download %}
-{% if mac.vlan_id %}
+{%     for mac in interface.mac %}
+{%         if mac.rate_upload and mac.rate_download %}
+{%             if mac.vlan_id %}
 {{ interface.name }}.{{ mac.vlan_id }} * {{ mac.address | lower }} * {{ mac.rate_download }}/{{ mac.rate_upload }}
-{% else %}
+{%             else %}
 {{ interface.name }} * {{ mac.address | lower }}  * {{ mac.rate_download }}/{{ mac.rate_upload }}
-{% endif %}
-{% else %}
-{% if mac.vlan_id %}
+{%             endif %}
+{%         else %}
+{%             if mac.vlan_id %}
 {{ interface.name }}.{{ mac.vlan_id }} * {{ mac.address | lower }} *
-{% else %}
+{%             else %}
 {{ interface.name }} * {{ mac.address | lower }}  *
-{% endif %}
-{% endif %}
-{% endfor %}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
 {% endfor %}
diff --git a/data/templates/accel-ppp/chap-secrets.tmpl b/data/templates/accel-ppp/chap-secrets.j2
index 6cace5401..cc3ddc28f 100644
--- a/data/templates/accel-ppp/chap-secrets.tmpl
+++ b/data/templates/accel-ppp/chap-secrets.j2
@@ -1,10 +1,10 @@
 # username  server  password  acceptable local IP addresses   shaper
 {% for user in local_users %}
-{% if user.state == 'enabled' %}
-{% if user.upload and user.download %}
+{%     if user.state == 'enabled' %}
+{%         if user.upload and user.download %}
 {{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }} {{ user.download }}/{{ user.upload }}
-{% else %}
+{%         else %}
 {{ "%-12s" | format(user.name) }} * {{ "%-16s" | format(user.password) }} {{ "%-16s" | format(user.ip) }}
-{% endif %}
-{% endif %}
+{%         endif %}
+{%     endif %}
 {% endfor %}
diff --git a/data/templates/accel-ppp/ipoe.config.tmpl b/data/templates/accel-ppp/ipoe.config.j2
index 92c2d5715..3c0d47b27 100644
--- a/data/templates/accel-ppp/ipoe.config.tmpl
+++ b/data/templates/accel-ppp/ipoe.config.j2
@@ -1,3 +1,4 @@
+{# j2lint: disable=operator-enclosed-by-spaces #}
 ### generated by ipoe.py ###
 [modules]
 log_syslog
@@ -24,45 +25,50 @@ level=5
 [ipoe]
 verbose=1
 {% for interface in interfaces %}
-{% if interface.vlan_mon %}
-interface=re:{{ interface.name }}\.\d+,{% else %}interface={{ interface.name }},{% endif %}shared={{ interface.shared }},mode={{ interface.mode }},ifcfg={{ interface.ifcfg }}{{ ',range=' + interface.range if interface.range is defined and interface.range is not none }},start={{ interface.sess_start }},ipv6=1
+{%     set tmp = 'interface=' %}
+{%     if interface.vlan_mon %}
+{%         set tmp = tmp ~ 're:' ~ interface.name ~ '\.\d+' %}
+{%     else %}
+{%         set tmp = tmp ~ interface.name %}
+{%     endif %}
+{{ tmp }},shared={{ interface.shared }},mode={{ interface.mode }},ifcfg={{ interface.ifcfg }}{{ ',range=' ~ interface.range if interface.range is defined and interface.range is not none }},start={{ interface.sess_start }},ipv6=1
 {% endfor %}
-{%   if auth_mode == 'noauth' %}
+{% if auth_mode == 'noauth' %}
 noauth=1
 {%     if client_named_ip_pool %}
-{%       for pool in client_named_ip_pool %}
-{%         if pool.subnet is defined  %}
+{%         for pool in client_named_ip_pool %}
+{%             if pool.subnet is defined  %}
 ip-pool={{ pool.name }}
-{%         endif %}
-{%         if pool.gateway_address is defined %}
+{%             endif %}
+{%             if pool.gateway_address is defined %}
 gw-ip-address={{ pool.gateway_address }}/{{ pool.subnet.split('/')[1] }}
-{%         endif %}
-{%       endfor%}
+{%             endif %}
+{%         endfor %}
 {%     endif %}
-{%   elif auth_mode == 'local' %}
+{% elif auth_mode == 'local' %}
 username=ifname
 password=csid
 {% endif %}
 proxy-arp=1
 
 {% for interface in interfaces %}
-{% if (interface.shared == '0') and (interface.vlan_mon) %}
+{%     if (interface.shared == '0') and (interface.vlan_mon) %}
 vlan-mon={{ interface.name }},{{ interface.vlan_mon | join(',') }}
-{% endif %}
+{%     endif %}
 {% endfor %}
 
 {% if dnsv4 %}
 [dns]
-{% for dns in dnsv4 %}
+{%     for dns in dnsv4 %}
 dns{{ loop.index }}={{ dns }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if dnsv6 %}
 [ipv6-dns]
-{% for dns in dnsv6 %}
+{%     for dns in dnsv6 %}
 {{ dns }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 [ipv6-nd]
@@ -73,24 +79,24 @@ verbose=1
 
 {% if client_named_ip_pool %}
 [ip-pool]
-{%   for pool in client_named_ip_pool %}
-{%     if pool.subnet is defined  %}
+{%     for pool in client_named_ip_pool %}
+{%         if pool.subnet is defined  %}
 {{ pool.subnet }},name={{ pool.name }}
-{%     endif %}
-{%     if pool.gateway_address is defined %}
+{%         endif %}
+{%         if pool.gateway_address is defined %}
 gw-ip-address={{ pool.gateway_address }}/{{ pool.subnet.split('/')[1] }}
-{%     endif %}
-{%   endfor%}
+{%         endif %}
+{%     endfor %}
 {% endif %}
 
 {% if client_ipv6_pool %}
 [ipv6-pool]
-{% for p in client_ipv6_pool %}
+{%     for p in client_ipv6_pool %}
 {{ p.prefix }},{{ p.mask }}
-{% endfor %}
-{% for p in client_ipv6_delegate_prefix %}
+{%     endfor %}
+{%     for p in client_ipv6_delegate_prefix %}
 delegate={{ p.prefix }},{{ p.mask }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if auth_mode == 'local' %}
@@ -99,39 +105,37 @@ chap-secrets={{ chap_secrets_file }}
 {% elif auth_mode == 'radius' %}
 [radius]
 verbose=1
-{% for r in radius_server %}
+{%     for r in radius_server %}
 server={{ r.server }},{{ r.key }},auth-port={{ r.port }},acct-port={{ r.acct_port }},req-limit=0,fail-time={{ r.fail_time }}
-{% endfor %}
+{%     endfor %}
 
-{% if radius_acct_inter_jitter %}
+{%     if radius_acct_inter_jitter %}
 acct-interim-jitter={{ radius_acct_inter_jitter }}
-{% endif %}
+{%     endif %}
 
 acct-timeout={{ radius_acct_tmo }}
 timeout={{ radius_timeout }}
 max-try={{ radius_max_try }}
-{% if radius_nas_id %}
+{%     if radius_nas_id %}
 nas-identifier={{ radius_nas_id }}
-{% endif %}
-{% if radius_nas_ip %}
+{%     endif %}
+{%     if radius_nas_ip %}
 nas-ip-address={{ radius_nas_ip }}
-{% endif %}
-{% if radius_source_address %}
+{%     endif %}
+{%     if radius_source_address %}
 bind={{ radius_source_address }}
-{% endif %}
-
-{% if radius_dynamic_author %}
+{%     endif %}
+{%     if radius_dynamic_author %}
 dae-server={{ radius_dynamic_author.server }}:{{ radius_dynamic_author.port }},{{ radius_dynamic_author.key }}
-{% endif %}
-
-{% if radius_shaper_attr %}
+{%     endif %}
+{%     if radius_shaper_attr %}
 [shaper]
 verbose=1
 attr={{ radius_shaper_attr }}
-{% if radius_shaper_vendor %}
+{%         if radius_shaper_vendor %}
 vendor={{ radius_shaper_vendor }}
-{% endif %}
-{% endif %}
+{%         endif %}
+{%     endif %}
 {% endif %}
 
 [cli]
diff --git a/data/templates/accel-ppp/l2tp.config.tmpl b/data/templates/accel-ppp/l2tp.config.j2
index 9fcda76d4..9eeaf7622 100644
--- a/data/templates/accel-ppp/l2tp.config.tmpl
+++ b/data/templates/accel-ppp/l2tp.config.j2
@@ -3,9 +3,9 @@
 log_syslog
 l2tp
 chap-secrets
-{% for proto in auth_proto: %}
-{{proto}}
-{% endfor%}
+{% for proto in auth_proto %}
+{{ proto }}
+{% endfor %}
 
 {% if auth_mode == 'radius' %}
 radius
@@ -18,7 +18,7 @@ ipv6_nd
 ipv6_dhcp
 
 [core]
-thread-count={{thread_cnt}}
+thread-count={{ thread_cnt }}
 
 [log]
 syslog=accel-l2tp,daemon
@@ -27,23 +27,23 @@ level=5
 
 {% if dnsv4 %}
 [dns]
-{% for dns in dnsv4 %}
+{%     for dns in dnsv4 %}
 dns{{ loop.index }}={{ dns }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if dnsv6 %}
 [ipv6-dns]
-{% for dns in dnsv6 %}
+{%     for dns in dnsv6 %}
 {{ dns }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if wins %}
 [wins]
-{% for server in wins %}
+{%     for server in wins %}
 wins{{ loop.index }}={{ server }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 [l2tp]
@@ -66,14 +66,14 @@ host-name={{ lns_host_name }}
 
 {% if client_ip_pool or client_ip_subnets %}
 [ip-pool]
-{% if client_ip_pool %}
+{%     if client_ip_pool %}
 {{ client_ip_pool }}
-{% endif %}
-{% if client_ip_subnets %}
-{% for sn in client_ip_subnets %}
-{{sn}}
-{% endfor %}
-{% endif %}
+{%     endif %}
+{%     if client_ip_subnets %}
+{%         for sn in client_ip_subnets %}
+{{ sn }}
+{%         endfor %}
+{%     endif %}
 {% endif %}
 {% if gateway_address %}
 gw-ip-address={{ gateway_address }}
@@ -85,27 +85,24 @@ chap-secrets={{ chap_secrets_file }}
 {% elif auth_mode == 'radius' %}
 [radius]
 verbose=1
-{% for r in radius_server %}
+{%     for r in radius_server %}
 server={{ r.server }},{{ r.key }},auth-port={{ r.port }},acct-port={{ r.acct_port }},req-limit=0,fail-time={{ r.fail_time }}
-{% endfor %}
-
-{% if radius_acct_inter_jitter %}
+{%     endfor %}
+{%     if radius_acct_inter_jitter %}
 acct-interim-jitter={{ radius_acct_inter_jitter }}
-{% endif %}
-
+{%     endif %}
 acct-timeout={{ radius_acct_tmo }}
 timeout={{ radius_timeout }}
 max-try={{ radius_max_try }}
-
-{% if radius_nas_id %}
+{%     if radius_nas_id %}
 nas-identifier={{ radius_nas_id }}
-{% endif %}
-{% if radius_nas_ip %}
+{%     endif %}
+{%     if radius_nas_ip %}
 nas-ip-address={{ radius_nas_ip }}
-{% endif %}
-{% if radius_source_address %}
+{%     endif %}
+{%     if radius_source_address %}
 bind={{ radius_source_address }}
-{% endif %}
+{%     endif %}
 {% endif %}
 {% if gateway_address %}
 gw-ip-address={{ gateway_address }}
@@ -128,12 +125,12 @@ ipv6=allow
 
 {% if client_ipv6_pool %}
 [ipv6-pool]
-{% for p in client_ipv6_pool %}
+{%     for p in client_ipv6_pool %}
 {{ p.prefix }},{{ p.mask }}
-{% endfor %}
-{% for p in client_ipv6_delegate_prefix %}
+{%     endfor %}
+{%     for p in client_ipv6_delegate_prefix %}
 delegate={{ p.prefix }},{{ p.mask }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if client_ipv6_delegate_prefix %}
@@ -145,9 +142,9 @@ verbose=1
 [shaper]
 verbose=1
 attr={{ radius_shaper_attr }}
-{% if radius_shaper_vendor %}
+{%     if radius_shaper_vendor %}
 vendor={{ radius_shaper_vendor }}
-{% endif %}
+{%     endif %}
 {% endif %}
 
 [cli]
diff --git a/data/templates/accel-ppp/pppoe.config.tmpl b/data/templates/accel-ppp/pppoe.config.j2
index 81b98cc81..0a92e2d54 100644
--- a/data/templates/accel-ppp/pppoe.config.tmpl
+++ b/data/templates/accel-ppp/pppoe.config.j2
@@ -49,9 +49,9 @@ disable
 
 {% if wins_server is vyos_defined %}
 [wins]
-{%   for server in wins_server %}
+{%     for server in wins_server %}
 wins{{ loop.index }}={{ server }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 {# Common chap-secrets and RADIUS server/option definitions #}
@@ -85,12 +85,12 @@ ipv4={{ ppp_options.ipv4 }}
 {# IPv6 #}
 {% if ppp_options.ipv6 is vyos_defined %}
 ipv6={{ ppp_options.ipv6 }}
-{%   if ppp_options.ipv6_intf_id is vyos_defined %}
+{%     if ppp_options.ipv6_intf_id is vyos_defined %}
 ipv6-intf-id={{ ppp_options.ipv6_intf_id }}
-{%   endif %}
-{%   if ppp_options.ipv6_peer_intf_id is vyos_defined %}
+{%     endif %}
+{%     if ppp_options.ipv6_peer_intf_id is vyos_defined %}
 ipv6-peer-intf-id={{ ppp_options.ipv6_peer_intf_id }}
-{%   endif %}
+{%     endif %}
 ipv6-accept-peer-intf-id={{ "1" if ppp_options.ipv6_accept_peer_intf_id is vyos_defined else "0" }}
 {% endif %}
 {# MTU #}
@@ -104,23 +104,23 @@ verbose=1
 ac-name={{ access_concentrator }}
 
 {% if interface is vyos_defined %}
-{%   for iface, iface_config in interface.items() %}
-{%     if iface_config.vlan_id is not vyos_defined and iface_config.vlan_range is not vyos_defined %}
+{%     for iface, iface_config in interface.items() %}
+{%         if iface_config.vlan_id is not vyos_defined and iface_config.vlan_range is not vyos_defined %}
 interface={{ iface }}
-{%     endif %}
-{%     if iface_config.vlan_range is vyos_defined %}
-{%       for regex in iface_config.regex %}
+{%         endif %}
+{%         if iface_config.vlan_range is vyos_defined %}
+{%             for regex in iface_config.regex %}
 interface=re:^{{ iface | replace('.', '\\.') }}\.({{ regex }})$
-{%       endfor %}
+{%             endfor %}
 vlan-mon={{ iface }},{{ iface_config.vlan_range | join(',') }}
-{%     endif %}
-{%     if iface_config.vlan_id is vyos_defined %}
-{%       for vlan in iface_config.vlan_id %}
+{%         endif %}
+{%         if iface_config.vlan_id is vyos_defined %}
+{%             for vlan in iface_config.vlan_id %}
 vlan-mon={{ iface }},{{ vlan }}
 interface=re:^{{ iface | replace('.', '\\.') }}\.{{ vlan }}$
-{%       endfor %}
-{%     endif %}
-{%   endfor %}
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
 
 {% if service_name %}
@@ -128,14 +128,14 @@ service-name={{ service_name | join(',') }}
 {% endif %}
 
 {% if pado_delay %}
-{%   set pado_delay_param = namespace(value='0') %}
-{%   for delay in pado_delay|sort(attribute='0') %}
-{%     if not loop.last %}
-{%       set pado_delay_param.value = pado_delay_param.value + ',' + delay + ':' + pado_delay[delay].sessions %}
-{%     else %}
-{%       set pado_delay_param.value = pado_delay_param.value + ',-1:' + pado_delay[delay].sessions %}
-{%     endif %}
-{%   endfor %}
+{%     set pado_delay_param = namespace(value='0') %}
+{%     for delay in pado_delay | sort(attribute='0') %}
+{%         if not loop.last %}
+{%             set pado_delay_param.value = pado_delay_param.value + ',' + delay + ':' + pado_delay[delay].sessions %}
+{%         else %}
+{%             set pado_delay_param.value = pado_delay_param.value + ',-1:' + pado_delay[delay].sessions %}
+{%         endif %}
+{%     endfor %}
 pado-delay={{ pado_delay_param.value }}
 {% endif %}
 {% if authentication.radius.called_sid_format is vyos_defined %}
@@ -144,15 +144,15 @@ called-sid={{ authentication.radius.called_sid_format }}
 
 {% if limits is vyos_defined %}
 [connlimit]
-{%   if limits.connection_limit is vyos_defined %}
+{%     if limits.connection_limit is vyos_defined %}
 limit={{ limits.connection_limit }}
-{%   endif %}
-{%   if limits.burst is vyos_defined %}
+{%     endif %}
+{%     if limits.burst is vyos_defined %}
 burst={{ limits.burst }}
-{%   endif %}
-{%   if limits.timeout is vyos_defined %}
+{%     endif %}
+{%     if limits.timeout is vyos_defined %}
 timeout={{ limits.timeout }}
-{%   endif %}
+{%     endif %}
 {% endif %}
 
 {# Common RADIUS shaper configuration #}
@@ -162,10 +162,10 @@ timeout={{ limits.timeout }}
 [pppd-compat]
 verbose=1
 radattr-prefix=/run/accel-pppd/radattr
-{% set script_name = {'on_up': 'ip-up', 'on_down': 'ip-down', 'on_change':'ip-change', 'on_pre_up':'ip-pre-up'} %}
-{%   for script in extended_scripts %}
+{%     set script_name = {'on_up': 'ip-up', 'on_down': 'ip-down', 'on_change':'ip-change', 'on_pre_up':'ip-pre-up'} %}
+{%     for script in extended_scripts %}
 {{ script_name[script] }}={{ extended_scripts[script] }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 [cli]
diff --git a/data/templates/accel-ppp/pptp.config.tmpl b/data/templates/accel-ppp/pptp.config.j2
index 3cfc4a906..cc1a45d6b 100644
--- a/data/templates/accel-ppp/pptp.config.tmpl
+++ b/data/templates/accel-ppp/pptp.config.j2
@@ -10,7 +10,7 @@ radius
 {% endif %}
 ippool
 {% for proto in auth_proto %}
-{{proto}}
+{{ proto }}
 {% endfor %}
 
 [core]
@@ -23,16 +23,16 @@ level=5
 
 {% if dnsv4 %}
 [dns]
-{% for dns in dnsv4 %}
+{%     for dns in dnsv4 %}
 dns{{ loop.index }}={{ dns }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if wins %}
 [wins]
-{% for server in wins %}
+{%     for server in wins %}
 wins{{ loop.index }}={{ server }}
-{% endfor %}
+{%     endfor %}
 {% endif %}
 
 
@@ -42,7 +42,7 @@ ifname=pptp%d
 bind={{ outside_addr }}
 {% endif %}
 verbose=1
-ppp-max-mtu={{mtu}}
+ppp-max-mtu={{ mtu }}
 mppe={{ ppp_mppe }}
 echo-interval=10
 echo-failure=3
@@ -66,27 +66,27 @@ chap-secrets={{ chap_secrets_file }}
 {% elif auth_mode == 'radius' %}
 [radius]
 verbose=1
-{% for r in radius_server %}
+{%     for r in radius_server %}
 server={{ r.server }},{{ r.key }},auth-port={{ r.port }},acct-port={{ r.acct_port }},req-limit=0,fail-time={{ r.fail_time }}
-{% endfor %}
+{%     endfor %}
 
-{% if radius_acct_inter_jitter %}
+{%     if radius_acct_inter_jitter %}
 acct-interim-jitter={{ radius_acct_inter_jitter }}
-{% endif %}
+{%     endif %}
 
 acct-timeout={{ radius_acct_tmo }}
 timeout={{ radius_timeout }}
 max-try={{ radius_max_try }}
 
-{% if radius_nas_id %}
+{%     if radius_nas_id %}
 nas-identifier={{ radius_nas_id }}
-{% endif %}
-{% if radius_nas_ip %}
+{%     endif %}
+{%     if radius_nas_ip %}
 nas-ip-address={{ radius_nas_ip }}
-{% endif %}
-{% if radius_source_address %}
+{%     endif %}
+{%     if radius_source_address %}
 bind={{ radius_source_address }}
-{% endif %}
+{%     endif %}
 {% endif %}
 {# Both chap-secrets and radius block required the gw-ip-address #}
 {% if gw_ip is defined and gw_ip is not none %}
diff --git a/data/templates/accel-ppp/sstp.config.tmpl b/data/templates/accel-ppp/sstp.config.j2
index 5c6f19306..5c6f19306 100644
--- a/data/templates/accel-ppp/sstp.config.tmpl
+++ b/data/templates/accel-ppp/sstp.config.j2
diff --git a/data/templates/bcast-relay/udp-broadcast-relay.tmpl b/data/templates/bcast-relay/udp-broadcast-relay.j2
index 75740e04c..75740e04c 100644
--- a/data/templates/bcast-relay/udp-broadcast-relay.tmpl
+++ b/data/templates/bcast-relay/udp-broadcast-relay.j2
diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2
new file mode 100644
index 000000000..16a03fc6e
--- /dev/null
+++ b/data/templates/conntrack/nftables-ct.j2
@@ -0,0 +1,48 @@
+#!/usr/sbin/nft -f
+
+{% set nft_ct_ignore_name = 'VYOS_CT_IGNORE' %}
+{% set nft_ct_timeout_name = 'VYOS_CT_TIMEOUT' %}
+
+# we first flush all chains and render the content from scratch - this makes
+# any delta check obsolete
+flush chain raw {{ nft_ct_ignore_name }}
+flush chain raw {{ nft_ct_timeout_name }}
+
+table raw {
+    chain {{ nft_ct_ignore_name }} {
+{% if ignore.rule is vyos_defined %}
+{%     for rule, rule_config in ignore.rule.items() %}
+        # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
+{%         set nft_command = '' %}
+{%         if rule_config.inbound_interface is vyos_defined %}
+{%             set nft_command = nft_command ~ ' iifname ' ~ rule_config.inbound_interface %}
+{%         endif %}
+{%         if rule_config.protocol is vyos_defined %}
+{%             set nft_command = nft_command ~ ' ip protocol ' ~ rule_config.protocol %}
+{%         endif %}
+{%         if rule_config.destination.address is vyos_defined %}
+{%             set nft_command = nft_command ~ ' ip daddr ' ~ rule_config.destination.address %}
+{%         endif %}
+{%         if rule_config.destination.port is vyos_defined %}
+{%             set nft_command = nft_command ~ ' ' ~ rule_config.protocol ~ ' dport { ' ~ rule_config.destination.port ~ ' }' %}
+{%         endif %}
+{%         if rule_config.source.address is vyos_defined %}
+{%             set nft_command = nft_command ~ ' ip saddr ' ~ rule_config.source.address %}
+{%         endif %}
+{%         if rule_config.source.port is vyos_defined %}
+{%             set nft_command = nft_command ~ ' ' ~ rule_config.protocol ~ ' sport { ' ~ rule_config.source.port ~ ' }' %}
+{%         endif %}
+       {{ nft_command }} counter notrack comment ignore-{{ rule }}
+{%     endfor %}
+{% endif %}
+        return
+    }
+    chain {{ nft_ct_timeout_name }} {
+{% if timeout.custom.rule is vyos_defined %}
+{%     for rule, rule_config in timeout.custom.rule.items() %}
+        # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
+{%     endfor %}
+{% endif %}
+        return
+    }
+}
diff --git a/data/templates/conntrack/nftables-ct.tmpl b/data/templates/conntrack/nftables-ct.tmpl
deleted file mode 100644
index 569e73df1..000000000
--- a/data/templates/conntrack/nftables-ct.tmpl
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/sbin/nft -f
-
-{% set nft_ct_ignore_name = 'VYOS_CT_IGNORE' %}
-{% set nft_ct_timeout_name = 'VYOS_CT_TIMEOUT' %}
-
-# we first flush all chains and render the content from scratch - this makes
-# any delta check obsolete
-flush chain raw {{ nft_ct_ignore_name }}
-flush chain raw {{ nft_ct_timeout_name }}
-
-table raw {
-    chain {{ nft_ct_ignore_name }} {
-{% if ignore.rule is vyos_defined %}
-{%   for rule, rule_config in ignore.rule.items() %}
-        # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
-{%     set nft_command = '' %}
-{%     if rule_config.inbound_interface is vyos_defined %}
-{%       set nft_command = nft_command ~ ' iifname ' ~ rule_config.inbound_interface %}
-{%     endif %}
-{%     if rule_config.protocol is vyos_defined %}
-{%       set nft_command = nft_command ~ ' ip protocol ' ~ rule_config.protocol %}
-{%     endif %}
-{%     if rule_config.destination.address is vyos_defined %}
-{%       set nft_command = nft_command ~ ' ip daddr ' ~ rule_config.destination.address %}
-{%     endif %}
-{%     if rule_config.destination.port is vyos_defined %}
-{%       set nft_command = nft_command ~ ' ' ~ rule_config.protocol ~ ' dport { ' ~ rule_config.destination.port ~ ' }' %}
-{%     endif %}
-{%     if rule_config.source.address is vyos_defined %}
-{%       set nft_command = nft_command ~ ' ip saddr ' ~ rule_config.source.address %}
-{%     endif %}
-{%     if rule_config.source.port is vyos_defined %}
-{%       set nft_command = nft_command ~ ' ' ~ rule_config.protocol ~ ' sport { ' ~ rule_config.source.port ~ ' }' %}
-{%     endif %}
-       {{ nft_command }} counter notrack comment ignore-{{ rule }}
-{%   endfor %}
-{% endif %}
-        return
-    }
-    chain {{ nft_ct_timeout_name }} {
-{% if timeout.custom.rule is vyos_defined %}
-{%   for rule, rule_config in timeout.custom.rule.items() %}
-        # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
-{%   endfor %}
-{% endif %}
-        return
-    }
-}
diff --git a/data/templates/conntrack/sysctl.conf.tmpl b/data/templates/conntrack/sysctl.conf.j2
index 075402c04..075402c04 100644
--- a/data/templates/conntrack/sysctl.conf.tmpl
+++ b/data/templates/conntrack/sysctl.conf.j2
diff --git a/data/templates/conntrack/vyos_nf_conntrack.conf.tmpl b/data/templates/conntrack/vyos_nf_conntrack.conf.j2
index 111459485..111459485 100644
--- a/data/templates/conntrack/vyos_nf_conntrack.conf.tmpl
+++ b/data/templates/conntrack/vyos_nf_conntrack.conf.j2
diff --git a/data/templates/conntrackd/conntrackd.conf.tmpl b/data/templates/conntrackd/conntrackd.conf.j2
index 80e7254a0..66024869d 100644
--- a/data/templates/conntrackd/conntrackd.conf.tmpl
+++ b/data/templates/conntrackd/conntrackd.conf.j2
@@ -6,11 +6,11 @@ Sync {
         DisableExternalCache {{ 'on' if disable_external_cache is vyos_defined else 'off' }}
     }
 {% for iface, iface_config in interface.items() %}
-{%   if iface_config.peer is vyos_defined %}
+{%     if iface_config.peer is vyos_defined %}
     UDP {
-{%     if listen_address is vyos_defined %}
+{%         if listen_address is vyos_defined %}
         IPv4_address {{ listen_address }}
-{%     endif %}
+{%         endif %}
         IPv4_Destination_Address {{ iface_config.peer }}
         Port {{ iface_config.port if iface_config.port is vyos_defined else '3780' }}
         Interface {{ iface }}
@@ -18,9 +18,9 @@ Sync {
         RcvSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         Checksum on
     }
-{%   else %}
+{%     else %}
     Multicast {
-{%     set ip_address = iface | get_ipv4 %}
+{%         set ip_address = iface | get_ipv4 %}
         IPv4_address {{ mcast_group }}
         Group {{ iface_config.port if iface_config.port is vyos_defined else '3780' }}
         IPv4_interface {{ ip_address[0] | ip_from_cidr }}
@@ -29,19 +29,19 @@ Sync {
         RcvSocketBuffer {{ sync_queue_size | int *1024 *1024 }}
         Checksum on
     }
-{%   endif %}
+{%     endif %}
 {% endfor %}
 {% if expect_sync is vyos_defined %}
     Options {
-{%   if 'all' in expect_sync %}
+{%     if 'all' in expect_sync %}
         ExpectationSync on
-{%   else %}
+{%     else %}
         ExpectationSync {
-{%     for protocol in expect_sync %}
+{%         for protocol in expect_sync %}
             {{ protocol }}
-{%     endfor %}
+{%         endfor %}
         }
-{%   endif %}
+{%     endif %}
     }
 {% endif %}
 }
@@ -85,27 +85,27 @@ General {
     NetlinkEventsReliable on
 {% if ignore_address is vyos_defined or accept_protocol is vyos_defined %}
     Filter From Userspace {
-{%   if ignore_address is vyos_defined %}
+{%     if ignore_address is vyos_defined %}
         Address Ignore {
-{%     for address in ignore_address if address | is_ipv4 %}
+{%         for address in ignore_address if address | is_ipv4 %}
             IPv4_address {{ address }}
-{%     endfor %}
-{%     for address in ignore_address if address | is_ipv6 %}
+{%         endfor %}
+{%         for address in ignore_address if address | is_ipv6 %}
             IPv6_address {{ address }}
-{%     endfor %}
+{%         endfor %}
         }
-{%   endif %}
-{%   if accept_protocol is vyos_defined %}
+{%     endif %}
+{%     if accept_protocol is vyos_defined %}
         Protocol Accept {
-{%     for protocol in accept_protocol %}
-{%       if protocol == 'icmp6' %}
+{%         for protocol in accept_protocol %}
+{%             if protocol == 'icmp6' %}
             IPv6-ICMP
-{%       else %}
+{%             else %}
             {{ protocol | upper }}
-{%       endif %}
-{%     endfor %}
+{%             endif %}
+{%         endfor %}
         }
-{%   endif %}
+{%     endif %}
     }
 {% endif %}
 }
diff --git a/data/templates/conntrackd/conntrackd.op-mode.j2 b/data/templates/conntrackd/conntrackd.op-mode.j2
new file mode 100644
index 000000000..82f7e2859
--- /dev/null
+++ b/data/templates/conntrackd/conntrackd.op-mode.j2
@@ -0,0 +1,13 @@
+Source                                           Destination                                      Protocol
+{% for parsed in data if parsed.flow.meta is vyos_defined %}
+{%     for key in parsed.flow.meta %}
+{%         if key['@direction'] == 'original' %}
+{%             set saddr    = key.layer3.src | bracketize_ipv6 %}
+{%             set sport    = key.layer4.sport %}
+{%             set daddr    = key.layer3.dst | bracketize_ipv6 %}
+{%             set dport    = key.layer4.dport %}
+{%             set protocol = key.layer4['@protoname'] %}
+{{ "%-48s" | format(saddr ~ ':' ~ sport) }} {{ "%-48s" | format(daddr ~ ':' ~ dport) }} {{ protocol }}
+{%         endif %}
+{%     endfor %}
+{% endfor %}
diff --git a/data/templates/conntrackd/conntrackd.op-mode.tmpl b/data/templates/conntrackd/conntrackd.op-mode.tmpl
deleted file mode 100644
index c3f6911ce..000000000
--- a/data/templates/conntrackd/conntrackd.op-mode.tmpl
+++ /dev/null
@@ -1,13 +0,0 @@
-Source                                           Destination                                      Protocol
-{% for parsed in data if parsed.flow.meta is vyos_defined %}
-{%   for key in parsed.flow.meta %}
-{%     if key['@direction'] == 'original' %}
-{%       set saddr    = key.layer3.src | bracketize_ipv6 %}
-{%       set sport    = key.layer4.sport %}
-{%       set daddr    = key.layer3.dst | bracketize_ipv6 %}
-{%       set dport    = key.layer4.dport %}
-{%       set protocol = key.layer4['@protoname'] %}
-{{ "%-48s" | format(saddr ~ ':' ~ sport) }} {{ "%-48s" | format(daddr ~ ':' ~ dport) }} {{ protocol }}
-{%     endif %}
-{%   endfor %}
-{% endfor %}
diff --git a/data/templates/conserver/conserver.conf.tmpl b/data/templates/conserver/conserver.conf.j2
index 4e7b5d8d7..1823657d7 100644
--- a/data/templates/conserver/conserver.conf.tmpl
+++ b/data/templates/conserver/conserver.conf.j2
@@ -17,7 +17,7 @@ default * {
 ##
 {% for key, value in device.items() %}
 {#   Depending on our USB serial console we could require a path adjustment #}
-{%   set path = '/dev' if key.startswith('ttyS') else '/dev/serial/by-bus' %}
+{%     set path = '/dev' if key.startswith('ttyS') else '/dev/serial/by-bus' %}
 console {{ key }} {
     master localhost;
     type device;
diff --git a/data/templates/conserver/dropbear@.service.tmpl b/data/templates/conserver/dropbear@.service.j2
index e355dab43..e355dab43 100644
--- a/data/templates/conserver/dropbear@.service.tmpl
+++ b/data/templates/conserver/dropbear@.service.j2
diff --git a/data/templates/container/registries.conf.j2 b/data/templates/container/registries.conf.j2
new file mode 100644
index 000000000..2e86466a1
--- /dev/null
+++ b/data/templates/container/registries.conf.j2
@@ -0,0 +1,27 @@
+### Autogenerated by container.py ###
+
+# For more information on this configuration file, see containers-registries.conf(5).
+#
+# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
+# We recommend always using fully qualified image names including the registry
+# server (full dns name), namespace, image name, and tag
+# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e.,
+# quay.io/repository/name@digest) further eliminates the ambiguity of tags.
+# When using short names, there is always an inherent risk that the image being
+# pulled could be spoofed. For example, a user wants to pull an image named
+# `foobar` from a registry and expects it to come from myregistry.com. If
+# myregistry.com is not first in the search list, an attacker could place a
+# different `foobar` image at a registry earlier in the search list. The user
+# would accidentally pull and run the attacker's image and code rather than the
+# intended content. We recommend only adding registries which are completely
+# trusted (i.e., registries which don't allow unknown or anonymous users to
+# create accounts with arbitrary names). This will prevent an image from being
+# spoofed, squatted or otherwise made insecure.  If it is necessary to use one
+# of these registries, it should be added at the end of the list.
+#
+# An array of host[:port] registries to try when pulling an unqualified image, in order.
+# unqualified-search-registries = ["example.com"]
+
+{% if registry is vyos_defined %}
+unqualified-search-registries = {{ registry }}
+{% endif %}
diff --git a/data/templates/container/storage.conf.j2 b/data/templates/container/storage.conf.j2
new file mode 100644
index 000000000..665f9bf95
--- /dev/null
+++ b/data/templates/container/storage.conf.j2
@@ -0,0 +1,4 @@
+### Autogenerated by container.py ###
+[storage]
+  driver = "vfs"
+  graphroot = "/usr/lib/live/mount/persistence/container/storage"
diff --git a/data/templates/containers/registry.tmpl b/data/templates/containers/registry.tmpl
deleted file mode 100644
index 0cbd9ecc2..000000000
--- a/data/templates/containers/registry.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-### Autogenerated by /usr/libexec/vyos/conf_mode/containers.py ###
-
-{% if registry is vyos_defined %}
-unqualified-search-registries = {{ registry }}
-{% endif %}
diff --git a/data/templates/containers/storage.tmpl b/data/templates/containers/storage.tmpl
deleted file mode 100644
index 3a69b7252..000000000
--- a/data/templates/containers/storage.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-### Autogenerated by /usr/libexec/vyos/conf_mode/containers.py ###
-
-[storage]
-  driver = "vfs"
-  graphroot = "/config/containers/storage"
diff --git a/data/templates/dhcp-server/dhcpd.conf.j2 b/data/templates/dhcp-server/dhcpd.conf.j2
index 40575cea2..4c2da0aa5 100644
--- a/data/templates/dhcp-server/dhcpd.conf.j2
+++ b/data/templates/dhcp-server/dhcpd.conf.j2
@@ -23,6 +23,15 @@ option rfc3442-static-route code 121 = array of integer 8;
 option windows-static-route code 249 = array of integer 8;
 option wpad-url code 252 = text;
 
+# Vendor specific options - Ubiquiti Networks
+option space ubnt;
+option ubnt.unifi-controller code 1 = ip-address;
+class "ubnt" {
+    match if substring (option vendor-class-identifier , 0, 4) = "ubnt";
+    option vendor-class-identifier "ubnt";
+    vendor-option-space ubnt;
+}
+
 {% if global_parameters is vyos_defined %}
 # The following {{ global_parameters | length }} line(s) have been added as
 # global-parameters in the CLI and have not been validated !!!
@@ -194,6 +203,9 @@ shared-network {{ network }} {
         }
 {%                     endfor %}
 {%                 endif %}
+{%                 if subnet_config.vendor_option.ubiquiti.unifi_controller is vyos_defined %}
+        option ubnt.unifi-controller {{ subnet_config.vendor_option.ubiquiti.unifi_controller }};
+{%                 endif %}
 {%                 if subnet_config.range is vyos_defined %}
 {#           pool configuration can only be used if there follows a range option #}
         pool {
diff --git a/data/templates/dhcp-server/dhcpdv6.conf.j2 b/data/templates/dhcp-server/dhcpdv6.conf.j2
index 284b7f269..5c3471316 100644
--- a/data/templates/dhcp-server/dhcpdv6.conf.j2
+++ b/data/templates/dhcp-server/dhcpdv6.conf.j2
@@ -12,6 +12,11 @@ option dhcp6.preference {{ preference }};
 option dhcp6.name-servers {{ global_parameters.name_server | join(', ') }};
 {% endif %}
 
+# Vendor specific options - Cisco
+option space cisco code width 2 length width 2;
+option cisco.tftp-servers code 1 = array of ip6-address;
+option vsio.cisco code 9 = encapsulate cisco;
+
 # Shared network configration(s)
 {% if shared_network_name is vyos_defined %}
 {%     for network, network_config in shared_network_name.items() if network_config.disable is not vyos_defined %}
@@ -113,6 +118,9 @@ shared-network {{ network }} {
         }
 {%                     endfor %}
 {%                 endif %}
+{%                 if subnet_config.vendor_option.cisco.tftp_server is vyos_defined %}
+        option cisco.tftp-servers {{ subnet_config.vendor_option.cisco.tftp_server | join(', ') }};
+{%                 endif %}
     }
 {%             endfor %}
 {%         endif %}
diff --git a/data/templates/firewall/nftables-defines.j2 b/data/templates/firewall/nftables-defines.j2
new file mode 100644
index 000000000..4fa92f2e3
--- /dev/null
+++ b/data/templates/firewall/nftables-defines.j2
@@ -0,0 +1,32 @@
+{% if group is vyos_defined %}
+{%     if group.address_group is vyos_defined %}
+{%         for group_name, group_conf in group.address_group.items() %}
+define A_{{ group_name }} = { {{ group_conf.address | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{%     if group.ipv6_address_group is vyos_defined %}
+{%         for group_name, group_conf in group.ipv6_address_group.items() %}
+define A6_{{ group_name }} = { {{ group_conf.address | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{%     if group.mac_group is vyos_defined %}
+{%         for group_name, group_conf in group.mac_group.items() %}
+define M_{{ group_name }} = { {{ group_conf.mac_address | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{%     if group.network_group is vyos_defined %}
+{%         for group_name, group_conf in group.network_group.items() %}
+define N_{{ group_name }} = { {{ group_conf.network | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{%     if group.ipv6_network_group is vyos_defined %}
+{%         for group_name, group_conf in group.ipv6_network_group.items() %}
+define N6_{{ group_name }} = { {{ group_conf.network | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{%     if group.port_group is vyos_defined %}
+{%         for group_name, group_conf in group.port_group.items() %}
+define P_{{ group_name }} = { {{ group_conf.port | join(",") }} }
+{%         endfor %}
+{%     endif %}
+{% endif %}
\ No newline at end of file
diff --git a/data/templates/firewall/nftables-defines.tmpl b/data/templates/firewall/nftables-defines.tmpl
deleted file mode 100644
index 66d31093b..000000000
--- a/data/templates/firewall/nftables-defines.tmpl
+++ /dev/null
@@ -1,32 +0,0 @@
-{% if group is vyos_defined %}
-{%   if group.address_group is vyos_defined %}
-{%     for group_name, group_conf in group.address_group.items() %}
-define A_{{ group_name }} = { {{ group_conf.address | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{%   if group.ipv6_address_group is vyos_defined %}
-{%     for group_name, group_conf in group.ipv6_address_group.items() %}
-define A6_{{ group_name }} = { {{ group_conf.address | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{%   if group.mac_group is vyos_defined %}
-{%     for group_name, group_conf in group.mac_group.items() %}
-define M_{{ group_name }} = { {{ group_conf.mac_address | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{%   if group.network_group is vyos_defined %}
-{%     for group_name, group_conf in group.network_group.items() %}
-define N_{{ group_name }} = { {{ group_conf.network | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{%   if group.ipv6_network_group is vyos_defined %}
-{%     for group_name, group_conf in group.ipv6_network_group.items() %}
-define N6_{{ group_name }} = { {{ group_conf.network | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{%   if group.port_group is vyos_defined %}
-{%     for group_name, group_conf in group.port_group.items() %}
-define P_{{ group_name }} = { {{ group_conf.port | join(",") }} }
-{%     endfor %}
-{%   endif %}
-{% endif %}
\ No newline at end of file
diff --git a/data/templates/firewall/nftables-nat.j2 b/data/templates/firewall/nftables-nat.j2
new file mode 100644
index 000000000..1481e9104
--- /dev/null
+++ b/data/templates/firewall/nftables-nat.j2
@@ -0,0 +1,182 @@
+#!/usr/sbin/nft -f
+
+{% macro nat_rule(rule, config, chain) %}
+{% set comment  = '' %}
+{% set base_log = '' %}
+{% set src_addr  = 'ip saddr ' ~ config.source.address.replace('!','!= ') if config.source.address is vyos_defined %}
+{% set dst_addr  = 'ip daddr ' ~ config.destination.address.replace('!','!= ') if config.destination.address is vyos_defined %}
+{# negated port groups need special treatment, move != in front of { } group #}
+{% if config.source.port is vyos_defined and config.source.port.startswith('!') %}
+{%     set src_port  = 'sport != { ' ~ config.source.port.replace('!','') ~ ' }' %}
+{% else %}
+{%     set src_port  = 'sport { ' ~ config.source.port ~ ' }' if config.source.port is vyos_defined %}
+{% endif %}
+{# negated port groups need special treatment, move != in front of { } group #}
+{% if config.destination.port is vyos_defined and config.destination.port.startswith('!') %}
+{%     set dst_port  = 'dport != { ' ~ config.destination.port.replace('!','') ~ ' }' %}
+{% else %}
+{%     set dst_port  = 'dport { ' ~ config.destination.port ~ ' }' if config.destination.port is vyos_defined %}
+{% endif %}
+{% if chain is vyos_defined('PREROUTING') %}
+{%     set comment   = 'DST-NAT-' ~ rule %}
+{%     set base_log  = '[NAT-DST-' ~ rule %}
+{%     set interface = ' iifname "' ~ config.inbound_interface ~ '"' if config.inbound_interface is vyos_defined and config.inbound_interface is not vyos_defined('any') else '' %}
+{%     if config.translation.address is vyos_defined %}
+{#         support 1:1 network translation #}
+{%         if config.translation.address | is_ip_network %}
+{%             set trns_addr = 'dnat ip prefix to ip daddr map { ' ~ config.destination.address ~ ' : ' ~ config.translation.address ~ ' }' %}
+{#             we can now clear out the dst_addr part as it's already covered in aboves map #}
+{%             set dst_addr  = '' %}
+{%         else %}
+{%             set trns_addr = 'dnat to ' ~ config.translation.address %}
+{%         endif %}
+{%     endif %}
+{% elif chain is vyos_defined('POSTROUTING') %}
+{%     set comment   = 'SRC-NAT-' ~ rule %}
+{%     set base_log  = '[NAT-SRC-' ~ rule %}
+{%     set interface = ' oifname "' ~ config.outbound_interface ~ '"' if config.outbound_interface is vyos_defined and config.outbound_interface is not vyos_defined('any') else '' %}
+{%     if config.translation.address is vyos_defined %}
+{%         if config.translation.address is vyos_defined('masquerade') %}
+{%             set trns_addr = config.translation.address %}
+{%             if config.translation.port is vyos_defined %}
+{%                 set trns_addr = trns_addr ~ ' to ' %}
+{%             endif %}
+{#         support 1:1 network translation #}
+{%         elif config.translation.address | is_ip_network %}
+{%             set trns_addr = 'snat ip prefix to ip saddr map { ' ~ config.source.address ~ ' : ' ~ config.translation.address ~ ' }' %}
+{#             we can now clear out the src_addr part as it's already covered in aboves map #}
+{%             set src_addr  = '' %}
+{%         else %}
+{%             set trns_addr = 'snat to ' ~ config.translation.address %}
+{%         endif %}
+{%     endif %}
+{% endif %}
+{% set trns_port = ':' ~ config.translation.port if config.translation.port is vyos_defined %}
+{# protocol has a default value thus it is always present #}
+{% if config.protocol is vyos_defined('tcp_udp') %}
+{%     set protocol  = 'tcp' %}
+{%     set comment   = comment ~ ' tcp_udp' %}
+{% else %}
+{%     set protocol  = config.protocol %}
+{% endif %}
+{% if config.log is vyos_defined %}
+{%     if config.exclude is vyos_defined %}
+{%         set log = base_log ~ '-EXCL]' %}
+{%     elif config.translation.address is vyos_defined('masquerade') %}
+{%         set log = base_log ~ '-MASQ]' %}
+{%     else %}
+{%         set log = base_log ~ ']' %}
+{%     endif %}
+{% endif %}
+{% if config.exclude is vyos_defined %}
+{#     rule has been marked as 'exclude' thus we simply return here #}
+{%     set trns_addr = 'return' %}
+{%     set trns_port = '' %}
+{% endif %}
+{# T1083: NAT address and port translation options #}
+{% if config.translation.options is vyos_defined %}
+{%     if config.translation.options.address_mapping is vyos_defined('persistent') %}
+{%         set trns_opts_addr  = 'persistent' %}
+{%     endif %}
+{%     if config.translation.options.port_mapping is vyos_defined('random') %}
+{%         set trns_opts_port  = 'random' %}
+{%     elif config.translation.options.port_mapping is vyos_defined('fully-random') %}
+{%         set trns_opts_port  = 'fully-random' %}
+{%     endif %}
+{% endif %}
+{% if trns_opts_addr is vyos_defined and trns_opts_port is vyos_defined %}
+{%     set trns_opts  = trns_opts_addr ~ ',' ~ trns_opts_port %}
+{% elif trns_opts_addr is vyos_defined %}
+{%     set trns_opts  = trns_opts_addr %}
+{% elif trns_opts_port is vyos_defined %}
+{%     set trns_opts  = trns_opts_port %}
+{% endif %}
+{% set output = 'add rule ip nat ' ~ chain ~ interface %}
+{% if protocol is not vyos_defined('all') %}
+{%     set output = output ~ ' ip protocol ' ~ protocol %}
+{% endif %}
+{% if src_addr is vyos_defined %}
+{%     set output = output ~ ' ' ~ src_addr %}
+{% endif %}
+{% if src_port is vyos_defined %}
+{%     set output = output ~ ' ' ~ protocol ~ ' ' ~ src_port %}
+{% endif %}
+{% if dst_addr is vyos_defined %}
+{%     set output = output ~ ' ' ~ dst_addr %}
+{% endif %}
+{% if dst_port is vyos_defined %}
+{%     set output = output ~ ' ' ~ protocol ~ ' ' ~ dst_port %}
+{% endif %}
+{# Count packets #}
+{% set output = output ~ ' counter' %}
+{# Special handling of log option, we must repeat the entire rule before the #}
+{# NAT translation options are added, this is essential                      #}
+{% if log is vyos_defined %}
+{%     set log_output = output ~ ' log prefix "' ~ log ~ '" comment "' ~ comment ~ '"' %}
+{% endif %}
+{% if trns_addr is vyos_defined %}
+{%     set output = output ~ ' ' ~ trns_addr %}
+{% endif %}
+{% if trns_port is vyos_defined %}
+{#     Do not add a whitespace here, translation port must be directly added after IP address #}
+{#     e.g. 192.0.2.10:3389                                                                   #}
+{%     set output = output ~ trns_port %}
+{% endif %}
+{% if trns_opts is vyos_defined %}
+{%     set output = output ~ ' ' ~ trns_opts %}
+{% endif %}
+{% if comment is vyos_defined %}
+{%     set output = output ~ ' comment "' ~ comment ~ '"' %}
+{% endif %}
+{{ log_output if log_output is vyos_defined }}
+{{ output }}
+{# Special handling if protocol is tcp_udp, we must repeat the entire rule with udp as protocol #}
+{% if config.protocol is vyos_defined('tcp_udp') %}
+{#     Beware of trailing whitespace, without it the comment tcp_udp will be changed to udp_udp #}
+{{ log_output | replace('tcp ', 'udp ') if log_output is vyos_defined }}
+{{ output | replace('tcp ', 'udp ') }}
+{% endif %}
+{% endmacro %}
+
+# Start with clean SNAT and DNAT chains
+flush chain ip nat PREROUTING
+flush chain ip nat POSTROUTING
+{% if helper_functions is vyos_defined('remove') %}
+{# NAT if going to be disabled - remove rules and targets from nftables #}
+{%     set base_command = 'delete rule ip raw' %}
+{{ base_command }} PREROUTING handle {{ pre_ct_ignore }}
+{{ base_command }} OUTPUT     handle {{ out_ct_ignore }}
+{{ base_command }} PREROUTING handle {{ pre_ct_conntrack }}
+{{ base_command }} OUTPUT     handle {{ out_ct_conntrack }}
+
+delete chain ip raw NAT_CONNTRACK
+
+{% elif helper_functions is vyos_defined('add') %}
+{# NAT if enabled - add targets to nftables #}
+add chain ip raw NAT_CONNTRACK
+add rule ip raw NAT_CONNTRACK counter accept
+{%     set base_command = 'add rule ip raw' %}
+{{ base_command }} PREROUTING position {{ pre_ct_ignore }}    counter jump VYOS_CT_HELPER
+{{ base_command }} OUTPUT     position {{ out_ct_ignore }}    counter jump VYOS_CT_HELPER
+{{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK
+{{ base_command }} OUTPUT     position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK
+{% endif %}
+
+#
+# Destination NAT rules build up here
+#
+add rule ip nat PREROUTING counter jump VYOS_PRE_DNAT_HOOK
+{% if destination.rule is vyos_defined %}
+{%     for rule, config in destination.rule.items() if config.disable is not vyos_defined %}
+{{ nat_rule(rule, config, 'PREROUTING') }}
+{%     endfor %}
+{% endif %}
+#
+# Source NAT rules build up here
+#
+add rule ip nat POSTROUTING counter jump VYOS_PRE_SNAT_HOOK
+{% if source.rule is vyos_defined %}
+{%     for rule, config in source.rule.items() if config.disable is not vyos_defined %}
+{{ nat_rule(rule, config, 'POSTROUTING') }}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl
deleted file mode 100644
index 922f3dcb4..000000000
--- a/data/templates/firewall/nftables-nat.tmpl
+++ /dev/null
@@ -1,179 +0,0 @@
-#!/usr/sbin/nft -f
-
-{% macro nat_rule(rule, config, chain) %}
-{%   set comment  = '' %}
-{%   set base_log = '' %}
-{%   set src_addr  = 'ip saddr ' ~ config.source.address.replace('!','!= ') if config.source.address is vyos_defined %}
-{%   set dst_addr  = 'ip daddr ' ~ config.destination.address.replace('!','!= ') if config.destination.address is vyos_defined %}
-{#   negated port groups need special treatment, move != in front of { } group #}
-{%   if config.source.port is vyos_defined and config.source.port.startswith('!=') %}
-{%     set src_port  = 'sport != { ' ~ config.source.port.replace('!=','') ~ ' }' %}
-{%   else %}
-{%     set src_port  = 'sport { ' ~ config.source.port ~ ' }' if config.source.port is vyos_defined %}
-{%   endif %}
-{#   negated port groups need special treatment, move != in front of { } group #}
-{%   if config.destination.port is vyos_defined and config.destination.port.startswith('!=') %}
-{%     set dst_port  = 'dport != { ' ~ config.destination.port.replace('!=','') ~ ' }' %}
-{%   else %}
-{%     set dst_port  = 'dport { ' ~ config.destination.port ~ ' }' if config.destination.port is vyos_defined %}
-{%   endif %}
-{%   if chain is vyos_defined('PREROUTING') %}
-{%     set comment   = 'DST-NAT-' ~ rule %}
-{%     set base_log  = '[NAT-DST-' ~ rule %}
-{%     set interface = ' iifname "' ~ config.inbound_interface ~ '"' if config.inbound_interface is vyos_defined and config.inbound_interface is not vyos_defined('any') else '' %}
-{%     if config.translation.address is vyos_defined %}
-{#       support 1:1 network translation #}
-{%       if config.translation.address | is_ip_network %}
-{%         set trns_addr = 'dnat ip prefix to ip daddr map { ' ~ config.destination.address ~ ' : ' ~ config.translation.address ~ ' }' %}
-{#         we can now clear out the dst_addr part as it's already covered in aboves map #}
-{%         set dst_addr  = '' %}
-{%       else %}
-{%         set trns_addr = 'dnat to ' ~ config.translation.address %}
-{%       endif %}
-{%     endif %}
-{%   elif chain is vyos_defined('POSTROUTING') %}
-{%     set comment   = 'SRC-NAT-' ~ rule %}
-{%     set base_log  = '[NAT-SRC-' ~ rule %}
-{%     set interface = ' oifname "' ~ config.outbound_interface ~ '"' if config.outbound_interface is vyos_defined and config.outbound_interface is not vyos_defined('any') else '' %}
-{%     if config.translation.address is vyos_defined %}
-{%       if config.translation.address is vyos_defined('masquerade') %}
-{%         set trns_addr = config.translation.address %}
-{%         if config.translation.port is vyos_defined %}
-{%           set trns_addr = trns_addr ~ ' to ' %}
-{%         endif %}
-{#       support 1:1 network translation #}
-{%       elif config.translation.address | is_ip_network %}
-{%         set trns_addr = 'snat ip prefix to ip saddr map { ' ~ config.source.address ~ ' : ' ~ config.translation.address ~ ' }' %}
-{#         we can now clear out the src_addr part as it's already covered in aboves map #}
-{%         set src_addr  = '' %}
-{%       else %}
-{%         set trns_addr = 'snat to ' ~ config.translation.address %}
-{%       endif %}
-{%     endif %}
-{%   endif %}
-{%   set trns_port = ':' ~ config.translation.port if config.translation.port is vyos_defined %}
-{#   protocol has a default value thus it is always present #}
-{%   if config.protocol is vyos_defined('tcp_udp') %}
-{%     set protocol  = 'tcp' %}
-{%     set comment   = comment ~ ' tcp_udp' %}
-{%   else %}
-{%     set protocol  = config.protocol %}
-{%   endif %}
-{%   if config.log is vyos_defined %}
-{%     if config.exclude is vyos_defined %}
-{%       set log = base_log ~ '-EXCL]' %}
-{%     elif config.translation.address is vyos_defined('masquerade') %}
-{%       set log = base_log +'-MASQ]' %}
-{%     else %}
-{%       set log = base_log ~ ']' %}
-{%     endif %}
-{%   endif %}
-{%   if config.exclude is vyos_defined %}
-{#     rule has been marked as 'exclude' thus we simply return here #}
-{%     set trns_addr = 'return' %}
-{%     set trns_port = '' %}
-{%   endif %}
-{#   T1083: NAT address and port translation options #}
-{%   if config.translation.options is vyos_defined %}
-{%     if config.translation.options.address_mapping is vyos_defined('persistent') %}
-{%         set trns_opts_addr  = 'persistent' %}
-{%     endif %}
-{%     if config.translation.options.port_mapping is vyos_defined('random') %}
-{%       set trns_opts_port  = 'random' %}
-{%     elif config.translation.options.port_mapping is vyos_defined('fully-random') %}
-{%       set trns_opts_port  = 'fully-random' %}
-{%     endif %}
-{%   endif %}
-{%   if trns_opts_addr is vyos_defined and trns_opts_port is vyos_defined %}
-{%     set trns_opts  = trns_opts_addr ~ ',' ~ trns_opts_port %}
-{%   elif trns_opts_addr is vyos_defined %}
-{%     set trns_opts  = trns_opts_addr %}
-{%   elif trns_opts_port is vyos_defined %}
-{%     set trns_opts  = trns_opts_port %}
-{%   endif %}
-{%   set output = 'add rule ip nat ' ~ chain ~ interface %}
-{%   if protocol is not vyos_defined('all') %}
-{%     set output = output ~ ' ip protocol ' ~ protocol %}
-{%   endif %}
-{%   if src_addr is vyos_defined %}
-{%     set output = output ~ ' ' ~ src_addr %}
-{%   endif %}
-{%   if src_port is vyos_defined %}
-{%     set output = output ~ ' ' ~ protocol ~ ' ' ~ src_port %}
-{%   endif %}
-{%   if dst_addr is vyos_defined %}
-{%     set output = output ~ ' ' ~ dst_addr %}
-{%   endif %}
-{%   if dst_port is vyos_defined %}
-{%     set output = output ~ ' ' ~ protocol ~ ' ' ~ dst_port %}
-{%   endif %}
-{#   Count packets #}
-{%   set output = output ~ ' counter' %}
-{#   Special handling of log option, we must repeat the entire rule before the #}
-{#   NAT translation options are added, this is essential                      #}
-{%   if log is vyos_defined %}
-{%     set log_output = output ~ ' log prefix "' ~ log ~ '" comment "' ~ comment ~ '"' %}
-{%   endif %}
-{%   if trns_addr is vyos_defined %}
-{%     set output = output ~ ' ' ~ trns_addr %}
-{%   endif %}
-{%   if trns_port is vyos_defined %}
-{#     Do not add a whitespace here, translation port must be directly added after IP address #}
-{#     e.g. 192.0.2.10:3389                                                                   #}
-{%     set output = output ~ trns_port %}
-{%   endif %}
-{%   if trns_opts is vyos_defined %}
-{%     set output = output ~ ' ' ~ trns_opts %}
-{%   endif %}
-{%   if comment is vyos_defined %}
-{%     set output = output ~ ' comment "' ~ comment ~ '"' %}
-{%   endif %}
-{{ log_output if log_output is vyos_defined}}
-{{ output }}
-{#   Special handling if protocol is tcp_udp, we must repeat the entire rule with udp as protocol #}
-{%   if config.protocol is vyos_defined('tcp_udp') %}
-{#     Beware of trailing whitespace, without it the comment tcp_udp will be changed to udp_udp #}
-{{ log_output | replace('tcp ', 'udp ') if log_output is vyos_defined }}
-{{ output | replace('tcp ', 'udp ') }}
-{%   endif %}
-{% endmacro %}
-
-# Start with clean NAT table
-flush table ip nat
-{% if helper_functions is vyos_defined('remove') %}
-{# NAT if going to be disabled - remove rules and targets from nftables #}
-{%   set base_command = 'delete rule ip raw' %}
-{{ base_command }} PREROUTING handle {{ pre_ct_ignore }}
-{{ base_command }} OUTPUT     handle {{ out_ct_ignore }}
-{{ base_command }} PREROUTING handle {{ pre_ct_conntrack }}
-{{ base_command }} OUTPUT     handle {{ out_ct_conntrack }}
-
-delete chain ip raw NAT_CONNTRACK
-
-{% elif helper_functions is vyos_defined('add') %}
-{# NAT if enabled - add targets to nftables #}
-add chain ip raw NAT_CONNTRACK
-add rule ip raw NAT_CONNTRACK counter accept
-{%   set base_command = 'add rule ip raw' %}
-{{ base_command }} PREROUTING position {{ pre_ct_ignore }}    counter jump VYOS_CT_HELPER
-{{ base_command }} OUTPUT     position {{ out_ct_ignore }}    counter jump VYOS_CT_HELPER
-{{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK
-{{ base_command }} OUTPUT     position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK
-{% endif %}
-
-#
-# Destination NAT rules build up here
-#
-{% if destination.rule is vyos_defined %}
-{%   for rule, config in destination.rule.items() if config.disable is not vyos_defined %}
-{{ nat_rule(rule, config, 'PREROUTING') }}
-{%   endfor %}
-{% endif %}
-#
-# Source NAT rules build up here
-#
-{% if source.rule is vyos_defined %}
-{%   for rule, config in source.rule.items() if config.disable is not vyos_defined %}
-{{ nat_rule(rule, config, 'POSTROUTING') }}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/firewall/nftables-nat66.tmpl b/data/templates/firewall/nftables-nat66.j2
index ed98b888a..003b138b2 100644
--- a/data/templates/firewall/nftables-nat66.tmpl
+++ b/data/templates/firewall/nftables-nat66.j2
@@ -1,22 +1,22 @@
 #!/usr/sbin/nft -f
 
 {% macro nptv6_rule(rule,config, chain) %}
-{%   set comment  = '' %}
-{%   set base_log = '' %}
-{%   set src_prefix  = 'ip6 saddr ' ~ config.source.prefix if config.source.prefix is vyos_defined %}
-{%   set dest_address  = 'ip6 daddr ' ~ config.destination.address if config.destination.address is vyos_defined %}
-{%   if chain is vyos_defined('PREROUTING') %}
+{% set comment  = '' %}
+{% set base_log = '' %}
+{% set src_prefix  = 'ip6 saddr ' ~ config.source.prefix if config.source.prefix is vyos_defined %}
+{% set dest_address  = 'ip6 daddr ' ~ config.destination.address if config.destination.address is vyos_defined %}
+{% if chain is vyos_defined('PREROUTING') %}
 {%     set comment   = 'DST-NAT66-' ~ rule %}
 {%     set base_log  = '[NAT66-DST-' ~ rule %}
 {%     set interface = ' iifname "' ~ config.inbound_interface ~ '"' if config.inbound_interface is vyos_defined and config.inbound_interface is not vyos_defined('any') else '' %}
 {%     if config.translation.address | is_ip_network %}
-{#       support 1:1 network translation #}
-{%       set dnat_type = 'dnat prefix to ' %}
+{#         support 1:1 network translation #}
+{%         set dnat_type = 'dnat prefix to ' %}
 {%     else   %}
-{%       set dnat_type = 'dnat to ' %}
+{%         set dnat_type = 'dnat to ' %}
 {%     endif %}
 {%     set trns_address = dnat_type ~ config.translation.address if config.translation.address is vyos_defined %}
-{%   elif chain is vyos_defined('POSTROUTING') %}
+{% elif chain is vyos_defined('POSTROUTING') %}
 {%     set comment   = 'SRC-NAT66-' ~ rule %}
 {%     set base_log  = '[NAT66-SRC-' ~ rule %}
 {%     if config.translation.address is vyos_defined %}
@@ -33,34 +33,34 @@
 {%         endif %}
 {%     endif   %}
 {%     set interface = ' oifname "' ~ config.outbound_interface ~ '"' if config.outbound_interface is vyos_defined else '' %}
-{%   endif %}
-{%   if config.log is vyos_defined %}
+{% endif %}
+{% if config.log is vyos_defined %}
 {%     if config.translation.address is vyos_defined('masquerade') %}
-{%       set log = base_log +'-MASQ]' %}
+{%         set log = base_log ~ '-MASQ]' %}
 {%     else %}
-{%       set log = base_log ~ ']' %}
+{%         set log = base_log ~ ']' %}
 {%     endif %}
-{%   endif %}
-{%   set output = 'add rule ip6 nat ' ~ chain ~ interface %}
-{#   Count packets #}
-{%   set output = output ~ ' counter' %}
-{#   Special handling of log option, we must repeat the entire rule before the #}
-{#   NAT translation options are added, this is essential                      #}
-{%   if log is vyos_defined %}
+{% endif %}
+{% set output = 'add rule ip6 nat ' ~ chain ~ interface %}
+{# Count packets #}
+{% set output = output ~ ' counter' %}
+{# Special handling of log option, we must repeat the entire rule before the #}
+{# NAT translation options are added, this is essential                      #}
+{% if log is vyos_defined %}
 {%     set log_output = output ~ ' log prefix "' ~ log ~ '" comment "' ~ comment ~ '"' %}
-{%   endif %}
-{%   if src_prefix is vyos_defined %}
+{% endif %}
+{% if src_prefix is vyos_defined %}
 {%     set output = output ~ ' ' ~ src_prefix %}
-{%   endif %}
-{%   if dest_address is vyos_defined %}
+{% endif %}
+{% if dest_address is vyos_defined %}
 {%     set output = output ~ ' ' ~ dest_address %}
-{%   endif %}
-{%   if trns_address is vyos_defined %}
+{% endif %}
+{% if trns_address is vyos_defined %}
 {%     set output = output ~ ' ' ~ trns_address %}
-{%   endif %}
-{%   if comment is vyos_defined %}
+{% endif %}
+{% if comment is vyos_defined %}
 {%     set output = output ~ ' comment "' ~ comment ~ '"' %}
-{%   endif %}
+{% endif %}
 {{ log_output if log_output is vyos_defined }}
 {{ output }}
 {% endmacro %}
@@ -69,9 +69,9 @@
 flush table ip6 nat
 {% if helper_functions is vyos_defined('remove') %}
 {# NAT if going to be disabled - remove rules and targets from nftables #}
-{%   set base_command = 'delete rule ip6 raw' %}
-{{base_command}} PREROUTING handle {{ pre_ct_conntrack }}
-{{base_command}} OUTPUT handle {{ out_ct_conntrack }}
+{%     set base_command = 'delete rule ip6 raw' %}
+{{ base_command }} PREROUTING handle {{ pre_ct_conntrack }}
+{{ base_command }} OUTPUT handle {{ out_ct_conntrack }}
 
 delete chain ip6 raw NAT_CONNTRACK
 
@@ -79,7 +79,7 @@ delete chain ip6 raw NAT_CONNTRACK
 {# NAT if enabled - add targets to nftables #}
 add chain ip6 raw NAT_CONNTRACK
 add rule ip6 raw NAT_CONNTRACK counter accept
-{%   set base_command = 'add rule ip6 raw' %}
+{%     set base_command = 'add rule ip6 raw' %}
 {{ base_command }} PREROUTING position {{ pre_ct_conntrack }} counter jump NAT_CONNTRACK
 {{ base_command }} OUTPUT     position {{ out_ct_conntrack }} counter jump NAT_CONNTRACK
 {% endif %}
@@ -88,15 +88,15 @@ add rule ip6 raw NAT_CONNTRACK counter accept
 # Destination NAT66 rules build up here
 #
 {% if destination.rule is vyos_defined %}
-{%   for rule, config in destination.rule.items() if config.disable is not vyos_defined %}
+{%     for rule, config in destination.rule.items() if config.disable is not vyos_defined %}
 {{ nptv6_rule(rule, config, 'PREROUTING') }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 #
 # Source NAT66 rules build up here
 #
 {% if source.rule is vyos_defined %}
-{%   for rule, config in source.rule.items() if config.disable is not vyos_defined %}
+{%     for rule, config in source.rule.items() if config.disable is not vyos_defined %}
 {{ nptv6_rule(rule, config, 'POSTROUTING') }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/firewall/nftables-policy.tmpl b/data/templates/firewall/nftables-policy.j2
index d1b0fa56e..0154c9f7e 100644
--- a/data/templates/firewall/nftables-policy.tmpl
+++ b/data/templates/firewall/nftables-policy.j2
@@ -1,9 +1,9 @@
 #!/usr/sbin/nft -f
 
 {% if cleanup_commands is vyos_defined %}
-{%   for command in cleanup_commands %}
+{%     for command in cleanup_commands %}
 {{ command }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 include "/run/nftables_defines.conf"
@@ -18,17 +18,17 @@ table ip mangle {
     }
 {% endif %}
 {% if route is vyos_defined %}
-{%   for route_text, conf in route.items() %}
+{%     for route_text, conf in route.items() %}
     chain VYOS_PBR_{{ route_text }} {
-{%     if conf.rule is vyos_defined %}
-{%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
         {{ rule_conf | nft_rule(route_text, rule_id, 'ip') }}
-{%       endfor %}
-{%     endif %}
+{%             endfor %}
+{%         endif %}
         {{ conf | nft_default_rule(route_text) }}
     }
-{%   endfor %}
-{%- endif %}
+{%     endfor %}
+{% endif %}
 }
 
 table ip6 mangle {
@@ -41,15 +41,15 @@ table ip6 mangle {
     }
 {% endif %}
 {% if route6 is vyos_defined %}
-{%   for route_text, conf in route6.items() %}
+{%     for route_text, conf in route6.items() %}
     chain VYOS_PBR6_{{ route_text }} {
-{%     if conf.rule is vyos_defined %}
-{%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
         {{ rule_conf | nft_rule(route_text, rule_id, 'ip6') }}
-{%       endfor %}
-{%     endif %}
+{%             endfor %}
+{%         endif %}
         {{ conf | nft_default_rule(route_text) }}
     }
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 }
diff --git a/data/templates/firewall/nftables-vrf-zones.tmpl b/data/templates/firewall/nftables-vrf-zones.j2
index eecf47b78..eecf47b78 100644
--- a/data/templates/firewall/nftables-vrf-zones.tmpl
+++ b/data/templates/firewall/nftables-vrf-zones.j2
diff --git a/data/templates/firewall/nftables.tmpl b/data/templates/firewall/nftables.j2
index 3a3f2e04c..fac3fad03 100644
--- a/data/templates/firewall/nftables.tmpl
+++ b/data/templates/firewall/nftables.j2
@@ -1,9 +1,9 @@
 #!/usr/sbin/nft -f
 
 {% if cleanup_commands is vyos_defined %}
-{%   for command in cleanup_commands %}
+{%     for command in cleanup_commands %}
 {{ command }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 include "/run/nftables_defines.conf"
@@ -31,39 +31,39 @@ table ip filter {
     }
 {% endif %}
 {% if name is vyos_defined %}
-{%   set ns = namespace(sets=[]) %}
-{%   for name_text, conf in name.items() %}
+{%     set ns = namespace(sets=[]) %}
+{%     for name_text, conf in name.items() %}
     chain NAME_{{ name_text }} {
-{%     if conf.rule is vyos_defined %}
-{%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
         {{ rule_conf | nft_rule(name_text, rule_id) }}
-{%         if rule_conf.recent is vyos_defined %}
-{%           set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%                 if rule_conf.recent is vyos_defined %}
+{%                     set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%                 endif %}
+{%             endfor %}
 {%         endif %}
-{%       endfor %}
-{%     endif %}
         {{ conf | nft_default_rule(name_text) }}
     }
-{%   endfor %}
-{%   for set_name in ns.sets %}
+{%     endfor %}
+{%     for set_name in ns.sets %}
     set RECENT_{{ set_name }} {
         type ipv4_addr
         size 65535
         flags dynamic
     }
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 {% if state_policy is vyos_defined %}
     chain VYOS_STATE_POLICY {
-{%   if state_policy.established is vyos_defined %}
+{%     if state_policy.established is vyos_defined %}
         {{ state_policy.established | nft_state_policy('established') }}
-{%   endif %}
-{%   if state_policy.invalid is vyos_defined %}
+{%     endif %}
+{%     if state_policy.invalid is vyos_defined %}
         {{ state_policy.invalid | nft_state_policy('invalid') }}
-{%   endif %}
-{%   if state_policy.related is vyos_defined %}
+{%     endif %}
+{%     if state_policy.related is vyos_defined %}
         {{ state_policy.related | nft_state_policy('related') }}
-{%   endif %}
+{%     endif %}
         return
     }
 {% endif %}
@@ -92,39 +92,39 @@ table ip6 filter {
     }
 {% endif %}
 {% if ipv6_name is vyos_defined %}
-{%   set ns = namespace(sets=[]) %}
-{%   for name_text, conf in ipv6_name.items() %}
+{%     set ns = namespace(sets=[]) %}
+{%     for name_text, conf in ipv6_name.items() %}
     chain NAME6_{{ name_text }} {
-{%     if conf.rule is vyos_defined %}
-{%       for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
         {{ rule_conf | nft_rule(name_text, rule_id, 'ip6') }}
-{%         if rule_conf.recent is vyos_defined %}
-{%           set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%                 if rule_conf.recent is vyos_defined %}
+{%                     set ns.sets = ns.sets + [name_text + '_' + rule_id] %}
+{%                 endif %}
+{%             endfor %}
 {%         endif %}
-{%       endfor %}
-{%     endif %}
         {{ conf | nft_default_rule(name_text) }}
     }
-{%   endfor %}
-{%   for set_name in ns.sets %}
+{%     endfor %}
+{%     for set_name in ns.sets %}
     set RECENT6_{{ set_name }} {
         type ipv6_addr
         size 65535
         flags dynamic
     }
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 {% if state_policy is vyos_defined %}
     chain VYOS_STATE_POLICY6 {
-{%   if state_policy.established is vyos_defined %}
+{%     if state_policy.established is vyos_defined %}
         {{ state_policy.established | nft_state_policy('established', ipv6=True) }}
-{%   endif %}
-{%   if state_policy.invalid is vyos_defined %}
+{%     endif %}
+{%     if state_policy.invalid is vyos_defined %}
         {{ state_policy.invalid | nft_state_policy('invalid', ipv6=True) }}
-{%   endif %}
-{%   if state_policy.related is vyos_defined %}
+{%     endif %}
+{%     if state_policy.related is vyos_defined %}
         {{ state_policy.related | nft_state_policy('related', ipv6=True) }}
-{%   endif %}
+{%     endif %}
         return
     }
 {% endif %}
diff --git a/data/templates/firewall/upnpd.conf.tmpl b/data/templates/firewall/upnpd.conf.j2
index 6e73995fa..27573cbf9 100644
--- a/data/templates/firewall/upnpd.conf.tmpl
+++ b/data/templates/firewall/upnpd.conf.j2
@@ -5,9 +5,9 @@ ext_ifname={{ wan_interface }}
 {% if wan_ip is vyos_defined %}
 # If the WAN interface has several IP addresses, you
 # can specify the one to use below
-{%   for addr in wan_ip %}
+{%     for addr in wan_ip %}
 ext_ip={{ addr }}
-{%   endfor  %}
+{%     endfor  %}
 {% endif %}
 
 # LAN network interfaces IPs / networks
@@ -20,15 +20,15 @@ ext_ip={{ addr }}
 # When MULTIPLE_EXTERNAL_IP is enabled, the external IP
 # address associated with the subnet follows. For example:
 #  listening_ip=192.168.0.1/24 88.22.44.13
-{%   for addr in listen %}
-{%     if addr | is_ipv4  %}
+{%     for addr in listen %}
+{%         if addr | is_ipv4  %}
 listening_ip={{ addr }}
-{%     elif addr | is_ipv6  %}
+{%         elif addr | is_ipv6  %}
 ipv6_listening_ip={{ addr }}
-{%     else %}
+{%         else %}
 listening_ip={{ addr }}
-{%     endif  %}
-{%   endfor  %}
+{%         endif  %}
+{%     endfor  %}
 {% endif %}
 
 # CAUTION: mixing up WAN and LAN interfaces may introduce security risks!
@@ -57,12 +57,12 @@ enable_upnp=yes
 # PCP
 # Configure the minimum and maximum lifetime of a port mapping in seconds
 # 120s and 86400s (24h) are suggested values from PCP-base
-{% if pcp_lifetime.max is vyos_defined %}
+{%     if pcp_lifetime.max is vyos_defined %}
 max_lifetime={{ pcp_lifetime.max }}
-{% endif %}
-{% if pcp_lifetime.min is vyos_defined %}
+{%     endif %}
+{%     if pcp_lifetime.min is vyos_defined %}
 min_lifetime={{ pcp_lifetime.min }}
-{% endif %}
+{%     endif %}
 {% endif %}
 
 
@@ -142,11 +142,11 @@ lease_file=/config/upnp.leases
 # modify the IP ranges to match their own internal networks, and
 # also consider implementing network-specific restrictions
 # CAUTION: failure to enforce any rules may permit insecure requests to be made!
-{% for rule, config in rules.items() %}
-{%  if config.disable is vyos_defined %}
-{{ config.action}} {{ config.external_port_range }} {{ config.ip }} {{ config.internal_port_range }}
-{%  endif %}
-{% endfor %}
+{%     for rule, config in rules.items() %}
+{%         if config.disable is vyos_defined %}
+{{ config.action }} {{ config.external_port_range }} {{ config.ip }} {{ config.internal_port_range }}
+{%         endif %}
+{%     endfor %}
 {% endif %}
 
 {% if stun is vyos_defined %}
diff --git a/data/templates/frr/policy.frr.j2 b/data/templates/frr/policy.frr.j2
index 9f3097f82..a42b73e98 100644
--- a/data/templates/frr/policy.frr.j2
+++ b/data/templates/frr/policy.frr.j2
@@ -238,11 +238,14 @@ route-map {{ route_map }} {{ rule_config.action }} {{ rule }}
 {%                     if rule_config.set.aggregator.as is vyos_defined and rule_config.set.aggregator.ip is vyos_defined %}
  set aggregator as {{ rule_config.set.aggregator.as }} {{ rule_config.set.aggregator.ip }}
 {%                     endif %}
-{%                     if rule_config.set.as_path_exclude is vyos_defined %}
- set as-path exclude {{ rule_config.set.as_path_exclude }}
+{%                     if rule_config.set.as_path.exclude is vyos_defined %}
+ set as-path exclude {{ rule_config.set.as_path.exclude }}
 {%                     endif %}
-{%                     if rule_config.set.as_path_prepend is vyos_defined %}
- set as-path prepend {{ rule_config.set.as_path_prepend }}
+{%                     if rule_config.set.as_path.prepend is vyos_defined %}
+ set as-path prepend {{ rule_config.set.as_path.prepend }}
+{%                     endif %}
+{%                     if rule_config.set.as_path.prepend_last_as is vyos_defined %}
+ set as-path prepend last-as {{ rule_config.set.as_path.prepend_last_as }}
 {%                     endif %}
 {%                     if rule_config.set.atomic_aggregate is vyos_defined %}
  set atomic-aggregate
@@ -256,6 +259,12 @@ route-map {{ route_map }} {{ rule_config.action }} {{ rule }}
 {%                     if rule_config.set.distance is vyos_defined %}
  set distance {{ rule_config.set.distance }}
 {%                     endif %}
+{%                     if rule_config.set.evpn.gateway.ipv4 is vyos_defined %}
+ set evpn gateway-ip ipv4 {{ rule_config.set.evpn.gateway.ipv4 }}
+{%                     endif %}
+{%                     if rule_config.set.evpn.gateway.ipv6 is vyos_defined %}
+ set evpn gateway-ip ipv6 {{ rule_config.set.evpn.gateway.ipv6 }}
+{%                     endif %}
 {%                     if rule_config.set.extcommunity.bandwidth is vyos_defined %}
  set extcommunity bandwidth {{ rule_config.set.extcommunity.bandwidth }}
 {%                     endif %}
diff --git a/data/templates/frr/staticd.frr.j2 b/data/templates/frr/staticd.frr.j2
index 08b2a3dab..589f03c2c 100644
--- a/data/templates/frr/staticd.frr.j2
+++ b/data/templates/frr/staticd.frr.j2
@@ -20,10 +20,16 @@ vrf {{ vrf }}
 {%     for interface, interface_config in dhcp.items() %}
 {%         set next_hop = interface | get_dhcp_router %}
 {%         if next_hop is vyos_defined %}
-{{ ip_prefix }} route 0.0.0.0/0 {{ next_hop }} {{ interface }} tag 210 {{ interface_config.distance }}
+{{ ip_prefix }} route 0.0.0.0/0 {{ next_hop }} {{ interface }} tag 210 {{ interface_config.dhcp_options.default_route_distance if interface_config.dhcp_options.default_route_distance is vyos_defined }}
 {%         endif %}
 {%     endfor %}
 {% endif %}
+{# IPv4 default routes from PPPoE interfaces #}
+{% if pppoe is vyos_defined %}
+{%     for interface, interface_config in pppoe.items() %}
+{{ ip_prefix }} route 0.0.0.0/0 {{ interface }} tag 210 {{ interface_config.default_route_distance if interface_config.default_route_distance is vyos_defined }}
+{%     endfor %}
+{% endif %}
 {# IPv6 routing #}
 {% if route6 is vyos_defined %}
 {%     for prefix, prefix_config in route6.items() %}
diff --git a/data/templates/getty/serial-getty.service.tmpl b/data/templates/getty/serial-getty.service.j2
index 0183eae7d..0183eae7d 100644
--- a/data/templates/getty/serial-getty.service.tmpl
+++ b/data/templates/getty/serial-getty.service.j2
diff --git a/data/templates/high-availability/keepalived.conf.j2 b/data/templates/high-availability/keepalived.conf.j2
new file mode 100644
index 000000000..6684dbc2c
--- /dev/null
+++ b/data/templates/high-availability/keepalived.conf.j2
@@ -0,0 +1,169 @@
+# Autogenerated by VyOS
+# Do not edit this file, all your changes will be lost
+# on next commit or reboot
+
+global_defs {
+    dynamic_interfaces
+    script_user root
+    notify_fifo /run/keepalived/keepalived_notify_fifo
+    notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
+}
+
+{% if vrrp.group is vyos_defined %}
+{%     for name, group_config in vrrp.group.items() if group_config.disable is not vyos_defined %}
+{%         if group_config.health_check.script is vyos_defined %}
+vrrp_script healthcheck_{{ name }} {
+    script "{{ group_config.health_check.script }}"
+    interval {{ group_config.health_check.interval }}
+    fall {{ group_config.health_check.failure_count }}
+    rise 1
+}
+{%         endif %}
+vrrp_instance {{ name }} {
+{%         if group_config.description is vyos_defined %}
+    # {{ group_config.description }}
+{%         endif %}
+    state BACKUP
+    interface {{ group_config.interface }}
+    virtual_router_id {{ group_config.vrid }}
+    priority {{ group_config.priority }}
+    advert_int {{ group_config.advertise_interval }}
+{%         if group_config.track.exclude_vrrp_interface is vyos_defined %}
+    dont_track_primary
+{%         endif %}
+{%         if group_config.no_preempt is not vyos_defined and group_config.preempt_delay is vyos_defined %}
+    preempt_delay {{ group_config.preempt_delay }}
+{%         elif group_config.no_preempt is vyos_defined %}
+    nopreempt
+{%         endif %}
+{%         if group_config.peer_address is vyos_defined %}
+    unicast_peer { {{ group_config.peer_address }} }
+{%         endif %}
+{%         if group_config.hello_source_address is vyos_defined %}
+{%             if group_config.peer_address is vyos_defined %}
+    unicast_src_ip {{ group_config.hello_source_address }}
+{%             else %}
+    mcast_src_ip {{ group_config.hello_source_address }}
+{%             endif %}
+{%         endif %}
+{%         if group_config.rfc3768_compatibility is vyos_defined and group_config.peer_address is vyos_defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+    vmac_xmit_base
+{%         elif group_config.rfc3768_compatibility is vyos_defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+{%         endif %}
+{%         if group_config.authentication is vyos_defined %}
+    authentication {
+        auth_pass "{{ group_config.authentication.password }}"
+{%             if group_config.authentication.type is vyos_defined('plaintext-password') %}
+        auth_type PASS
+{%             else %}
+        auth_type {{ group_config.authentication.type | upper }}
+{%             endif %}
+    }
+{%         endif %}
+{%         if group_config.address is vyos_defined %}
+    virtual_ipaddress {
+{%             for addr, addr_config in group_config.address.items() %}
+        {{ addr }}{{ ' dev ' + addr_config.interface if addr_config.interface is vyos_defined }}
+{%             endfor %}
+    }
+{%         endif %}
+{%         if group_config.excluded_address is vyos_defined %}
+    virtual_ipaddress_excluded {
+{%             for addr in group_config.excluded_address %}
+        {{ addr }}
+{%             endfor %}
+    }
+{%         endif %}
+{%         if group_config.track.interface is vyos_defined %}
+    track_interface {
+{%             for interface in group_config.track.interface %}
+        {{ interface }}
+{%             endfor %}
+    }
+{%         endif %}
+{%         if group_config.health_check.script is vyos_defined %}
+    track_script {
+        healthcheck_{{ name }}
+    }
+{%         endif %}
+}
+{%     endfor %}
+{% endif %}
+
+{% if vrrp.sync_group is vyos_defined %}
+{%     for name, sync_group_config in vrrp.sync_group.items() if sync_group_config.disable is not vyos_defined %}
+vrrp_sync_group {{ name }} {
+    group {
+{%         if sync_group_config.member is vyos_defined %}
+{%             for member in sync_group_config.member %}
+        {{ member }}
+{%             endfor %}
+{%         endif %}
+    }
+
+{# Health-check scripts should be in section sync-group if member is part of the sync-group T4081 #}
+{%         if vrrp.group is vyos_defined %}
+{%             for name, group_config in vrrp.group.items() if group_config.disable is not vyos_defined %}
+{%                 if group_config.health_check.script is vyos_defined and name in sync_group_config.member %}
+    track_script {
+        healthcheck_{{ name }}
+    }
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if conntrack_sync_group is vyos_defined(name) %}
+{%             set vyos_helper = "/usr/libexec/vyos/vyos-vrrp-conntracksync.sh" %}
+    notify_master "{{ vyos_helper }} master {{ name }}"
+    notify_backup "{{ vyos_helper }} backup {{ name }}"
+    notify_fault "{{ vyos_helper }} fault {{ name }}"
+{%         endif %}
+}
+{%     endfor %}
+{% endif %}
+
+{% if virtual_server is vyos_defined %}
+# Virtual-server configuration
+{%     for vserver, vserver_config in virtual_server.items() %}
+virtual_server {{ vserver }} {{ vserver_config.port }} {
+    delay_loop {{ vserver_config.delay_loop }}
+{%         if vserver_config.algorithm is vyos_defined('round-robin') %}
+    lb_algo rr
+{%         elif vserver_config.algorithm is vyos_defined('weighted-round-robin') %}
+    lb_algo wrr
+{%         elif vserver_config.algorithm is vyos_defined('least-connection') %}
+    lb_algo lc
+{%         elif vserver_config.algorithm is vyos_defined('weighted-least-connection') %}
+    lb_algo wlc
+{%         elif vserver_config.algorithm is vyos_defined('source-hashing') %}
+    lb_algo sh
+{%         elif vserver_config.algorithm is vyos_defined('destination-hashing') %}
+    lb_algo dh
+{%         elif vserver_config.algorithm is vyos_defined('locality-based-least-connection') %}
+    lb_algo lblc
+{%         endif %}
+{%         if vserver_config.forward_method is vyos_defined('nat') %}
+    lb_kind NAT
+{%         elif vserver_config.forward_method is vyos_defined('direct') %}
+    lb_kind DR
+{%         elif vserver_config.forward_method is vyos_defined('tunnel') %}
+    lb_kind TUN
+{%         endif %}
+    persistence_timeout {{ vserver_config.persistence_timeout }}
+    protocol {{ vserver_config.protocol | upper }}
+{%         if vserver_config.real_server is vyos_defined %}
+{%             for rserver, rserver_config in vserver_config.real_server.items() %}
+    real_server {{ rserver }} {{ rserver_config.port }} {
+        weight 1
+        {{ vserver_config.protocol | upper }}_CHECK {
+{%                 if rserver_config.connection_timeout is vyos_defined %}
+            connect_timeout {{ rserver_config.connection_timeout }}
+{%                 endif %}
+        }
+    }
+{%             endfor %}
+{%         endif %}
+}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/high-availability/keepalived.conf.tmpl b/data/templates/high-availability/keepalived.conf.tmpl
deleted file mode 100644
index 202760251..000000000
--- a/data/templates/high-availability/keepalived.conf.tmpl
+++ /dev/null
@@ -1,169 +0,0 @@
-# Autogenerated by VyOS
-# Do not edit this file, all your changes will be lost
-# on next commit or reboot
-
-global_defs {
-    dynamic_interfaces
-    script_user root
-    notify_fifo /run/keepalived/keepalived_notify_fifo
-    notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
-}
-
-{% if vrrp.group is vyos_defined %}
-{%   for name, group_config in vrrp.group.items() if group_config.disable is not vyos_defined %}
-{%     if group_config.health_check.script is vyos_defined %}
-vrrp_script healthcheck_{{ name }} {
-    script "{{ group_config.health_check.script }}"
-    interval {{ group_config.health_check.interval }}
-    fall {{ group_config.health_check.failure_count }}
-    rise 1
-}
-{%     endif %}
-vrrp_instance {{ name }} {
-{%     if group_config.description is vyos_defined %}
-    # {{ group_config.description }}
-{%     endif %}
-    state BACKUP
-    interface {{ group_config.interface }}
-    virtual_router_id {{ group_config.vrid }}
-    priority {{ group_config.priority }}
-    advert_int {{ group_config.advertise_interval }}
-{%     if group_config.track.exclude_vrrp_interface is vyos_defined %}
-    dont_track_primary
-{%     endif %}
-{%     if group_config.no_preempt is not vyos_defined and group_config.preempt_delay is vyos_defined %}
-    preempt_delay {{ group_config.preempt_delay }}
-{%     elif group_config.no_preempt is vyos_defined %}
-    nopreempt
-{%     endif %}
-{%     if group_config.peer_address is vyos_defined %}
-    unicast_peer { {{ group_config.peer_address }} }
-{%     endif %}
-{%     if group_config.hello_source_address is vyos_defined %}
-{%       if group_config.peer_address is vyos_defined %}
-    unicast_src_ip {{ group_config.hello_source_address }}
-{%       else %}
-    mcast_src_ip {{ group_config.hello_source_address }}
-{%       endif %}
-{%     endif %}
-{%     if group_config.rfc3768_compatibility is vyos_defined and group_config.peer_address is vyos_defined %}
-    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
-    vmac_xmit_base
-{%     elif group_config.rfc3768_compatibility is vyos_defined %}
-    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
-{%     endif %}
-{%     if group_config.authentication is vyos_defined %}
-    authentication {
-        auth_pass "{{ group_config.authentication.password }}"
-{%       if group_config.authentication.type is vyos_defined('plaintext-password') %}
-        auth_type PASS
-{%       else %}
-        auth_type {{ group_config.authentication.type | upper }}
-{%       endif %}
-    }
-{%     endif %}
-{%     if group_config.address is vyos_defined %}
-    virtual_ipaddress {
-{%       for addr, addr_config in group_config.address.items() %}
-        {{ addr }}{{ ' dev ' + addr_config.interface if addr_config.interface is vyos_defined }}
-{%       endfor %}
-    }
-{%     endif %}
-{%     if group_config.excluded_address is vyos_defined %}
-    virtual_ipaddress_excluded {
-{%       for addr in group_config.excluded_address %}
-        {{ addr }}
-{%       endfor %}
-    }
-{%     endif %}
-{%     if group_config.track.interface is vyos_defined %}
-    track_interface {
-{%       for interface in group_config.track.interface %}
-        {{ interface }}
-{%       endfor %}
-    }
-{%     endif %}
-{%     if group_config.health_check.script is vyos_defined %}
-    track_script {
-        healthcheck_{{ name }}
-    }
-{%     endif %}
-}
-{%   endfor %}
-{% endif %}
-
-{% if vrrp.sync_group is vyos_defined %}
-{%   for name, sync_group_config in vrrp.sync_group.items() if sync_group_config.disable is not vyos_defined %}
-vrrp_sync_group {{ name }} {
-    group {
-{%     if sync_group_config.member is vyos_defined %}
-{%       for member in sync_group_config.member %}
-        {{ member }}
-{%       endfor %}
-{%     endif %}
-    }
-
-{# Health-check scripts should be in section sync-group if member is part of the sync-group T4081 #}
-{%     if vrrp.group is vyos_defined %}
-{%       for name, group_config in vrrp.group.items() if group_config.disable is not vyos_defined %}
-{%         if group_config.health_check.script is vyos_defined and name in sync_group_config.member %}
-    track_script {
-        healthcheck_{{ name }}
-    }
-{%         endif %}
-{%       endfor %}
-{%     endif %}
-{%     if conntrack_sync_group is vyos_defined(name) %}
-{%     set vyos_helper = "/usr/libexec/vyos/vyos-vrrp-conntracksync.sh" %}
-    notify_master "{{ vyos_helper }} master {{ name }}"
-    notify_backup "{{ vyos_helper }} backup {{ name }}"
-    notify_fault "{{ vyos_helper }} fault {{ name }}"
-{%     endif %}
-}
-{%   endfor %}
-{% endif %}
-
-{% if virtual_server is vyos_defined %}
-# Virtual-server configuration
-{%   for vserver, vserver_config in virtual_server.items() %}
-virtual_server {{ vserver }} {{ vserver_config.port }} {
-    delay_loop {{ vserver_config.delay_loop }}
-{%     if vserver_config.algorithm is vyos_defined('round-robin') %}
-    lb_algo rr
-{%     elif vserver_config.algorithm is vyos_defined('weighted-round-robin') %}
-    lb_algo wrr
-{%     elif vserver_config.algorithm is vyos_defined('least-connection') %}
-    lb_algo lc
-{%     elif vserver_config.algorithm is vyos_defined('weighted-least-connection') %}
-    lb_algo wlc
-{%     elif vserver_config.algorithm is vyos_defined('source-hashing') %}
-    lb_algo sh
-{%     elif vserver_config.algorithm is vyos_defined('destination-hashing') %}
-    lb_algo dh
-{%     elif vserver_config.algorithm is vyos_defined('locality-based-least-connection') %}
-    lb_algo lblc
-{%     endif %}
-{%     if vserver_config.forward_method is vyos_defined('nat') %}
-    lb_kind NAT
-{%     elif vserver_config.forward_method is vyos_defined('direct') %}
-    lb_kind DR
-{%     elif vserver_config.forward_method is vyos_defined('tunnel') %}
-    lb_kind TUN
-{%     endif %}
-    persistence_timeout {{ vserver_config.persistence_timeout }}
-    protocol {{ vserver_config.protocol | upper }}
-{%     if vserver_config.real_server is vyos_defined %}
-{%       for rserver, rserver_config in vserver_config.real_server.items() %}
-    real_server {{ rserver }} {{ rserver_config.port }} {
-        weight 1
-        {{ vserver_config.protocol | upper }}_CHECK {
-{%         if rserver_config.connection_timeout is vyos_defined %}
-            connect_timeout {{ rserver_config.connection_timeout }}
-{%         endif %}
-        }
-    }
-{%        endfor %}
-{%      endif %}
-}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/https/nginx.default.tmpl b/data/templates/https/nginx.default.j2
index a51505270..70e62ae7a 100644
--- a/data/templates/https/nginx.default.tmpl
+++ b/data/templates/https/nginx.default.j2
@@ -1,59 +1,56 @@
 ### Autogenerated by https.py ###
 # Default server configuration
-#
 
 {% for server in server_block_list %}
 server {
-
         # SSL configuration
         #
-{% if server.address == '*' %}
+{%     if server.address == '*' %}
         listen {{ server.port }} ssl;
         listen [::]:{{ server.port }} ssl;
-{% else %}
+{%     else %}
         listen {{ server.address | bracketize_ipv6 }}:{{ server.port }} ssl;
-{% endif %}
+{%     endif %}
 
-{% for name in server.name %}
+{%     for name in server.name %}
         server_name {{ name }};
-{% endfor %}
+{%     endfor %}
 
-{% if server.certbot %}
+{%     if server.certbot %}
         ssl_certificate {{ server.certbot_dir }}/live/{{ server.certbot_domain_dir }}/fullchain.pem;
         ssl_certificate_key {{ server.certbot_dir }}/live/{{ server.certbot_domain_dir }}/privkey.pem;
         include {{ server.certbot_dir }}/options-ssl-nginx.conf;
         ssl_dhparam {{ server.certbot_dir }}/ssl-dhparams.pem;
-{% elif server.vyos_cert %}
+{%     elif server.vyos_cert %}
         ssl_certificate {{ server.vyos_cert.crt }};
         ssl_certificate_key {{ server.vyos_cert.key }};
-{% else %}
+{%     else %}
         #
         # Self signed certs generated by the ssl-cert package
         # Don't use them in a production server!
         #
         include snippets/snakeoil.conf;
-{% endif %}
+{%     endif %}
         ssl_protocols TLSv1.2 TLSv1.3;
 
         # proxy settings for HTTP API, if enabled; 503, if not
         location ~ /(retrieve|configure|config-file|image|generate|show|docs|openapi.json|redoc|graphql) {
-{% if server.api %}
-{% if server.api.socket %}
+{%     if server.api %}
+{%         if server.api.socket %}
                 proxy_pass http://unix:/run/api.sock;
-{% else %}
+{%         else %}
                 proxy_pass http://localhost:{{ server.api.port }};
-{% endif %}
+{%         endif %}
                 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                 proxy_set_header X-Forwarded-Proto $scheme;
                 proxy_read_timeout 600;
                 proxy_buffering off;
-{% else %}
+{%     else %}
                 return 503;
-{% endif %}
+{%     endif %}
         }
 
         error_page 497 =301 https://$host:{{ server.port }}$request_uri;
-
 }
 
 {% endfor %}
diff --git a/data/templates/https/override.conf.tmpl b/data/templates/https/override.conf.j2
index c2c191b06..c2c191b06 100644
--- a/data/templates/https/override.conf.tmpl
+++ b/data/templates/https/override.conf.j2
diff --git a/data/templates/https/vyos-http-api.service.tmpl b/data/templates/https/vyos-http-api.service.j2
index fb424e06c..fb424e06c 100644
--- a/data/templates/https/vyos-http-api.service.tmpl
+++ b/data/templates/https/vyos-http-api.service.j2
diff --git a/data/templates/ids/fastnetmon.tmpl b/data/templates/ids/fastnetmon.j2
index b6bef9a68..c482002fa 100644
--- a/data/templates/ids/fastnetmon.tmpl
+++ b/data/templates/ids/fastnetmon.j2
@@ -29,22 +29,22 @@ enable_subnet_counters = off
 mirror_afpacket = on
 {% endif %}
 
-process_incoming_traffic = {{ 'on' if direction is vyos_defined and 'in' in direction else 'off '}}
-process_outgoing_traffic = {{ 'on' if direction is vyos_defined and 'out' in direction else 'off '}}
+process_incoming_traffic = {{ 'on' if direction is vyos_defined and 'in' in direction else 'off' }}
+process_outgoing_traffic = {{ 'on' if direction is vyos_defined and 'out' in direction else 'off' }}
 
 {% if threshold is vyos_defined %}
-{%   for thr, thr_value in threshold.items() %}
-{%     if thr is vyos_defined('fps') %}
+{%     for thr, thr_value in threshold.items() %}
+{%         if thr is vyos_defined('fps') %}
 ban_for_flows = on
 threshold_flows = {{ thr_value }}
-{%     elif thr is vyos_defined('mbps') %}
+{%         elif thr is vyos_defined('mbps') %}
 ban_for_bandwidth = on
 threshold_mbps = {{ thr_value }}
-{%     elif thr is vyos_defined('pps') %}
+{%         elif thr is vyos_defined('pps') %}
 ban_for_pps = on
 threshold_pps = {{ thr_value }}
-{%     endif %}
-{%   endfor %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
 
 {% if listen_interface is vyos_defined %}
diff --git a/data/templates/ids/fastnetmon_networks_list.tmpl b/data/templates/ids/fastnetmon_networks_list.j2
index ab9add22c..1c81180be 100644
--- a/data/templates/ids/fastnetmon_networks_list.tmpl
+++ b/data/templates/ids/fastnetmon_networks_list.j2
@@ -1,7 +1,7 @@
 {% if network is vyos_defined(var_type=str) %}
 {{ network }}
 {% else %}
-{%   for net in network %}
+{%     for net in network %}
 {{ net }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/igmp-proxy/igmpproxy.conf.tmpl b/data/templates/igmp-proxy/igmpproxy.conf.j2
index f32d68e43..ab3c9fd31 100644
--- a/data/templates/igmp-proxy/igmpproxy.conf.tmpl
+++ b/data/templates/igmp-proxy/igmpproxy.conf.j2
@@ -18,23 +18,23 @@
 quickleave
 {% endif %}
 {% if interface is vyos_defined %}
-{%   for iface, config in interface.items() %}
+{%     for iface, config in interface.items() %}
 
 # Configuration for {{ iface }} ({{ config.role }} interface)
-{%     if config.role is vyos_defined('disabled') %}
+{%         if config.role is vyos_defined('disabled') %}
 phyint {{ iface }} disabled
-{%     else %}
+{%         else %}
 phyint {{ iface }} {{ config.role }} ratelimit 0 threshold {{ config.threshold }}
-{%     endif %}
-{%     if config.alt_subnet is vyos_defined %}
-{%       for subnet in config.alt_subnet %}
+{%         endif %}
+{%         if config.alt_subnet is vyos_defined %}
+{%             for subnet in config.alt_subnet %}
         altnet {{ subnet }}
-{%       endfor %}
-{%     endif %}
-{%     if config.whitelist is vyos_defined %}
-{%       for subnet in config.whitelist %}
+{%             endfor %}
+{%         endif %}
+{%         if config.whitelist is vyos_defined %}
+{%             for subnet in config.whitelist %}
         whitelist {{ subnet }}
-{%       endfor %}
-{%     endif %}
-{%   endfor %}
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/ipsec/charon.tmpl b/data/templates/ipsec/charon.j2
index 2eac24eaa..388559af8 100644
--- a/data/templates/ipsec/charon.tmpl
+++ b/data/templates/ipsec/charon.j2
@@ -1,6 +1,5 @@
 # Options for the charon IKE daemon.
 charon {
-
     # Accept unencrypted ID and HASH payloads in IKEv1 Main Mode.
     # accept_unencrypted_mainmode_messages = no
 
@@ -23,13 +22,13 @@ charon {
     # Cisco FlexVPN
 {% if options is vyos_defined %}
     cisco_flexvpn = {{ 'yes' if options.flexvpn is vyos_defined else 'no' }}
-{%   if options.virtual_ip is vyos_defined %}
+{%     if options.virtual_ip is vyos_defined %}
     install_virtual_ip = yes
-{%   endif %}
-{%   if options.interface is vyos_defined %}
+{%     endif %}
+{%     if options.interface is vyos_defined %}
     install_virtual_ip_on = {{ options.interface }}
-{%   endif %}
-{%  endif %}
+{%     endif %}
+{% endif %}
 
     # Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed.
     # close_ike_on_child_failure = no
diff --git a/data/templates/ipsec/charon/dhcp.conf.tmpl b/data/templates/ipsec/charon/dhcp.conf.j2
index aaa5613fb..aaa5613fb 100644
--- a/data/templates/ipsec/charon/dhcp.conf.tmpl
+++ b/data/templates/ipsec/charon/dhcp.conf.j2
diff --git a/data/templates/ipsec/charon/eap-radius.conf.tmpl b/data/templates/ipsec/charon/eap-radius.conf.j2
index b58022521..8495011fe 100644
--- a/data/templates/ipsec/charon/eap-radius.conf.tmpl
+++ b/data/templates/ipsec/charon/eap-radius.conf.j2
@@ -94,19 +94,19 @@ eap-radius {
 
     # Section to specify multiple RADIUS servers.
     servers {
-{%  if remote_access.radius.server is vyos_defined %}
-{%    for server, server_options in remote_access.radius.server.items() if server_options.disable is not vyos_defined %}
+{% if remote_access.radius.server is vyos_defined %}
+{%     for server, server_options in remote_access.radius.server.items() if server_options.disable is not vyos_defined %}
         {{ server | replace('.', '-') }} {
             address = {{ server }}
             secret = {{ server_options.key }}
             auth_port = {{ server_options.port }}
-{%      if server_options.disable_accounting is not vyos_defined %}
-            acct_port = {{ server_options.port | int +1 }}
-{%  endif %}
+{%         if server_options.disable_accounting is not vyos_defined %}
+            acct_port = {{ server_options.port | int + 1 }}
+{%         endif %}
             sockets = 20
         }
-{%    endfor %}
-{%  endif %}
+{%     endfor %}
+{% endif %}
     }
 
     # Section to configure multiple XAuth authentication rounds via RADIUS.
diff --git a/data/templates/ipsec/interfaces_use.conf.tmpl b/data/templates/ipsec/interfaces_use.conf.j2
index 55c3ce4f3..c1bf8270d 100644
--- a/data/templates/ipsec/interfaces_use.conf.tmpl
+++ b/data/templates/ipsec/interfaces_use.conf.j2
@@ -1,5 +1,5 @@
-{%  if interface is vyos_defined %}
+{% if interface is vyos_defined %}
 charon {
     interfaces_use = {{ ', '.join(interface) }}
 }
-{%  endif %}
\ No newline at end of file
+{% endif %}
\ No newline at end of file
diff --git a/data/templates/ipsec/ios_profile.tmpl b/data/templates/ipsec/ios_profile.j2
index c8e17729a..c8e17729a 100644
--- a/data/templates/ipsec/ios_profile.tmpl
+++ b/data/templates/ipsec/ios_profile.j2
diff --git a/data/templates/ipsec/ipsec.conf.j2 b/data/templates/ipsec/ipsec.conf.j2
new file mode 100644
index 000000000..f63995b38
--- /dev/null
+++ b/data/templates/ipsec/ipsec.conf.j2
@@ -0,0 +1,19 @@
+# Created by VyOS - manual changes will be overwritten
+
+config setup
+{% set charondebug = '' %}
+{% if log.subsystem is vyos_defined %}
+{%     set subsystem = log.subsystem %}
+{%     if 'any' in log.subsystem %}
+{%         set subsystem = ['dmn', 'mgr', 'ike', 'chd','job', 'cfg', 'knl',
+                            'net', 'asn', 'enc', 'lib', 'esp', 'tls', 'tnc',
+                            'imc', 'imv', 'pts'] %}
+{%     endif %}
+{%     set charondebug = subsystem | join (' ' ~ log.level ~ ', ') ~ ' ' ~ log.level %}
+{% endif %}
+    charondebug = "{{ charondebug }}"
+    uniqueids = {{ "no" if disable_uniqreqids is vyos_defined else "yes" }}
+
+{% if include_ipsec_conf is vyos_defined %}
+include {{ include_ipsec_conf }}
+{% endif %}
diff --git a/data/templates/ipsec/ipsec.conf.tmpl b/data/templates/ipsec/ipsec.conf.tmpl
deleted file mode 100644
index 0f7131dff..000000000
--- a/data/templates/ipsec/ipsec.conf.tmpl
+++ /dev/null
@@ -1,18 +0,0 @@
-# Created by VyOS - manual changes will be overwritten
-
-config setup
-{% set charondebug = '' %}
-{% if log.subsystem is vyos_defined %}
-{%   set subsystem = log.subsystem %}
-{%   if 'any' in log.subsystem %}
-{%     set subsystem = ['dmn', 'mgr', 'ike', 'chd','job', 'cfg', 'knl', 'net', 'asn',
-                        'enc', 'lib', 'esp', 'tls', 'tnc', 'imc', 'imv', 'pts'] %}
-{%   endif %}
-{%   set charondebug = subsystem | join (' ' ~ log.level ~ ', ') ~ ' ' ~ log.level %}
-{% endif %}
-    charondebug = "{{ charondebug }}"
-    uniqueids = {{ "no" if disable_uniqreqids is vyos_defined else "yes" }}
-
-{%  if include_ipsec_conf is vyos_defined %}
-include {{ include_ipsec_conf }}
-{%  endif %}
diff --git a/data/templates/ipsec/ipsec.secrets.tmpl b/data/templates/ipsec/ipsec.secrets.j2
index 865c1ab17..a87ac9bc7 100644
--- a/data/templates/ipsec/ipsec.secrets.tmpl
+++ b/data/templates/ipsec/ipsec.secrets.j2
@@ -1,5 +1,5 @@
 # Created by VyOS - manual changes will be overwritten
 
-{%  if include_ipsec_secrets is vyos_defined %}
+{% if include_ipsec_secrets is vyos_defined %}
 include {{ include_ipsec_secrets }}
-{%  endif %}
+{% endif %}
diff --git a/data/templates/ipsec/swanctl.conf.j2 b/data/templates/ipsec/swanctl.conf.j2
new file mode 100644
index 000000000..bf6b8259c
--- /dev/null
+++ b/data/templates/ipsec/swanctl.conf.j2
@@ -0,0 +1,131 @@
+### Autogenerated by vpn_ipsec.py ###
+{% import 'ipsec/swanctl/l2tp.j2' as l2tp_tmpl %}
+{% import 'ipsec/swanctl/profile.j2' as profile_tmpl %}
+{% import 'ipsec/swanctl/peer.j2' as peer_tmpl %}
+{% import 'ipsec/swanctl/remote_access.j2' as remote_access_tmpl %}
+
+connections {
+{% if profile is vyos_defined %}
+{%     for name, profile_conf in profile.items() if profile_conf.disable is not vyos_defined and profile_conf.bind.tunnel is vyos_defined %}
+{{ profile_tmpl.conn(name, profile_conf, ike_group, esp_group) }}
+{%     endfor %}
+{% endif %}
+{% if site_to_site.peer is vyos_defined %}
+{%     for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not vyos_defined %}
+{{ peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }}
+{%     endfor %}
+{% endif %}
+{% if remote_access.connection is vyos_defined %}
+{%     for rw, rw_conf in remote_access.connection.items() if rw_conf.disable is not vyos_defined %}
+{{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
+{%     endfor %}
+{% endif %}
+{% if l2tp %}
+{{ l2tp_tmpl.conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) }}
+{% endif %}
+}
+
+pools {
+{% if remote_access.pool is vyos_defined %}
+{%     for pool, pool_config in remote_access.pool.items() %}
+    {{ pool }} {
+{%         if pool_config.prefix is vyos_defined %}
+        addrs = {{ pool_config.prefix }}
+{%         endif %}
+{%         if pool_config.name_server is vyos_defined %}
+        dns = {{ pool_config.name_server | join(',') }}
+{%         endif %}
+{%         if pool_config.exclude is vyos_defined %}
+        split_exclude = {{ pool_config.exclude | join(',') }}
+{%         endif %}
+    }
+{%     endfor %}
+{% endif %}
+}
+
+secrets {
+{% if profile is vyos_defined %}
+{%     for name, profile_conf in profile.items() if profile_conf.disable is not vyos_defined and profile_conf.bind.tunnel is vyos_defined %}
+{%         if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
+{%             for interface in profile_conf.bind.tunnel %}
+    ike-dmvpn-{{ interface }} {
+        secret = {{ profile_conf.authentication.pre_shared_secret }}
+    }
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+{% if site_to_site.peer is vyos_defined %}
+{%     for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not vyos_defined %}
+{%         set peer_name = peer.replace("@", "") | dot_colon_to_dash %}
+{%         if peer_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
+    ike_{{ peer_name }} {
+{%             if peer_conf.local_address is vyos_defined %}
+        id-local = {{ peer_conf.local_address }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }}
+{%             endif %}
+        id-remote = {{ peer }}
+{%             if peer_conf.authentication.id is vyos_defined %}
+        id-localid = {{ peer_conf.authentication.id }}
+{%             endif %}
+{%             if peer_conf.authentication.remote_id is vyos_defined %}
+        id-remoteid = {{ peer_conf.authentication.remote_id }}
+{%             endif %}
+        secret = "{{ peer_conf.authentication.pre_shared_secret }}"
+    }
+{%         elif peer_conf.authentication.mode is vyos_defined('x509') %}
+    private_{{ peer_name }} {
+        file = {{ peer_conf.authentication.x509.certificate }}.pem
+{%             if peer_conf.authentication.x509.passphrase is vyos_defined %}
+        secret = "{{ peer_conf.authentication.x509.passphrase }}"
+{%             endif %}
+    }
+{%         elif peer_conf.authentication.mode is vyos_defined('rsa') %}
+    rsa_{{ peer_name }}_local {
+        file = {{ peer_conf.authentication.rsa.local_key }}.pem
+{%             if peer_conf.authentication.rsa.passphrase is vyos_defined %}
+        secret = "{{ peer_conf.authentication.rsa.passphrase }}"
+{%             endif %}
+    }
+{%         endif %}
+{%     endfor %}
+{% endif %}
+{% if remote_access.connection is vyos_defined %}
+{%     for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not vyos_defined %}
+{%         if ra_conf.authentication.server_mode is vyos_defined('pre-shared-secret') %}
+    ike_{{ ra }} {
+{%             if ra_conf.authentication.id is vyos_defined %}
+        id = "{{ ra_conf.authentication.id }}"
+{%             elif ra_conf.local_address is vyos_defined %}
+        id = "{{ ra_conf.local_address }}"
+{%             endif %}
+        secret = "{{ ra_conf.authentication.pre_shared_secret }}"
+    }
+{%         endif %}
+{%         if ra_conf.authentication.client_mode is vyos_defined('eap-mschapv2') and ra_conf.authentication.local_users.username is vyos_defined %}
+{%             for user, user_conf in ra_conf.authentication.local_users.username.items() if user_conf.disable is not vyos_defined %}
+    eap-{{ ra }}-{{ user }} {
+        secret = "{{ user_conf.password }}"
+        id-{{ ra }}-{{ user }} = "{{ user }}"
+    }
+{%             endfor %}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+{% if l2tp %}
+{%     if l2tp.authentication.mode is vyos_defined('pre-shared-secret') %}
+    ike_l2tp_remote_access {
+        id = "{{ l2tp_outside_address }}"
+        secret = "{{ l2tp.authentication.pre_shared_secret }}"
+    }
+{%     elif l2tp.authentication.mode is vyos_defined('x509') %}
+    private_l2tp_remote_access {
+        id = "{{ l2tp_outside_address }}"
+        file = {{ l2tp.authentication.x509.certificate }}.pem
+{%         if l2tp.authentication.x509.passphrase is vyos_defined %}
+        secret = "{{ l2tp.authentication.x509.passphrase }}"
+{%         endif %}
+    }
+{%     endif %}
+{% endif %}
+}
+
diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl
deleted file mode 100644
index 6ba93dd1f..000000000
--- a/data/templates/ipsec/swanctl.conf.tmpl
+++ /dev/null
@@ -1,131 +0,0 @@
-### Autogenerated by vpn_ipsec.py ###
-{% import 'ipsec/swanctl/l2tp.tmpl' as l2tp_tmpl %}
-{% import 'ipsec/swanctl/profile.tmpl' as profile_tmpl %}
-{% import 'ipsec/swanctl/peer.tmpl' as peer_tmpl %}
-{% import 'ipsec/swanctl/remote_access.tmpl' as remote_access_tmpl %}
-
-connections {
-{% if profile is vyos_defined %}
-{%   for name, profile_conf in profile.items() if profile_conf.disable is not vyos_defined and profile_conf.bind.tunnel is vyos_defined %}
-{{     profile_tmpl.conn(name, profile_conf, ike_group, esp_group) }}
-{%   endfor %}
-{% endif %}
-{% if site_to_site.peer is vyos_defined %}
-{%   for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not vyos_defined %}
-{{     peer_tmpl.conn(peer, peer_conf, ike_group, esp_group) }}
-{%   endfor %}
-{%  endif %}
-{% if remote_access.connection is vyos_defined %}
-{%   for rw, rw_conf in remote_access.connection.items() if rw_conf.disable is not vyos_defined %}
-{{ remote_access_tmpl.conn(rw, rw_conf, ike_group, esp_group) }}
-{%   endfor %}
-{% endif %}
-{% if l2tp %}
-{{ l2tp_tmpl.conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) }}
-{% endif %}
-}
-
-pools {
-{%  if remote_access.pool is vyos_defined %}
-{%    for pool, pool_config in remote_access.pool.items() %}
-    {{ pool }} {
-{%      if pool_config.prefix is vyos_defined %}
-        addrs = {{ pool_config.prefix }}
-{%      endif %}
-{%      if pool_config.name_server is vyos_defined %}
-        dns = {{ pool_config.name_server | join(',') }}
-{%      endif %}
-{%      if pool_config.exclude is vyos_defined %}
-        split_exclude = {{ pool_config.exclude | join(',') }}
-{%      endif %}
-    }
-{%    endfor %}
-{%  endif %}
-}
-
-secrets {
-{%  if profile is vyos_defined %}
-{%    for name, profile_conf in profile.items() if profile_conf.disable is not vyos_defined and profile_conf.bind.tunnel is vyos_defined %}
-{%      if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
-{%        for interface in profile_conf.bind.tunnel %}
-    ike-dmvpn-{{ interface }} {
-        secret = {{ profile_conf.authentication.pre_shared_secret }}
-    }
-{%        endfor %}
-{%      endif %}
-{%    endfor %}
-{%  endif %}
-{%  if site_to_site.peer is vyos_defined %}
-{%    for peer, peer_conf in site_to_site.peer.items() if peer not in dhcp_no_address and peer_conf.disable is not vyos_defined %}
-{%      set peer_name = peer.replace("@", "") | dot_colon_to_dash %}
-{%      if peer_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
-    ike_{{ peer_name }} {
-{%        if peer_conf.local_address is vyos_defined %}
-        id-local = {{ peer_conf.local_address }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }}
-{%        endif %}
-        id-remote = {{ peer }}
-{%        if peer_conf.authentication.id is vyos_defined %}
-        id-localid = {{ peer_conf.authentication.id }}
-{%        endif %}
-{%        if peer_conf.authentication.remote_id is vyos_defined %}
-        id-remoteid = {{ peer_conf.authentication.remote_id }}
-{%        endif %}
-        secret = "{{ peer_conf.authentication.pre_shared_secret }}"
-    }
-{%      elif peer_conf.authentication.mode is vyos_defined('x509') %}
-    private_{{ peer_name }} {
-        file = {{ peer_conf.authentication.x509.certificate }}.pem
-{%        if peer_conf.authentication.x509.passphrase is vyos_defined %}
-        secret = "{{ peer_conf.authentication.x509.passphrase }}"
-{%        endif %}
-    }
-{%      elif peer_conf.authentication.mode is vyos_defined('rsa') %}
-    rsa_{{ peer_name }}_local {
-        file = {{ peer_conf.authentication.rsa.local_key }}.pem
-{%        if peer_conf.authentication.rsa.passphrase is vyos_defined %}
-        secret = "{{ peer_conf.authentication.rsa.passphrase }}"
-{%        endif %}
-    }
-{%      endif %}
-{%    endfor %}
-{%  endif %}
-{%  if remote_access.connection is vyos_defined %}
-{%    for ra, ra_conf in remote_access.connection.items() if ra_conf.disable is not vyos_defined %}
-{%      if ra_conf.authentication.server_mode is vyos_defined('pre-shared-secret') %}
-    ike_{{ ra }} {
-{%        if ra_conf.authentication.id is vyos_defined %}
-        id = "{{ ra_conf.authentication.id }}"
-{%        elif ra_conf.local_address is vyos_defined %}
-        id = "{{ ra_conf.local_address }}"
-{%        endif %}
-        secret = "{{ ra_conf.authentication.pre_shared_secret }}"
-    }
-{%      endif %}
-{%      if ra_conf.authentication.client_mode is vyos_defined('eap-mschapv2') and ra_conf.authentication.local_users.username is vyos_defined %}
-{%        for user, user_conf in ra_conf.authentication.local_users.username.items() if user_conf.disable is not vyos_defined %}
-    eap-{{ ra }}-{{ user }} {
-        secret = "{{ user_conf.password }}"
-        id-{{ ra }}-{{ user }} = "{{ user }}"
-    }
-{%        endfor %}
-{%      endif %}
-{%    endfor %}
-{%  endif %}
-{%  if l2tp %}
-{%    if l2tp.authentication.mode is vyos_defined('pre-shared-secret') %}
-    ike_l2tp_remote_access {
-        id = "{{ l2tp_outside_address }}"
-        secret = "{{ l2tp.authentication.pre_shared_secret }}"
-    }
-{%    elif l2tp.authentication.mode is vyos_defined('x509') %}
-    private_l2tp_remote_access {
-        id = "{{ l2tp_outside_address }}"
-        file = {{ l2tp.authentication.x509.certificate }}.pem
-{%      if l2tp.authentication.x509.passphrase is vyos_defined %}
-        secret = "{{ l2tp.authentication.x509.passphrase }}"
-{%      endif %}
-    }
-{%    endif %}
-{%  endif %}
-}
-
diff --git a/data/templates/ipsec/swanctl/l2tp.tmpl b/data/templates/ipsec/swanctl/l2tp.j2
index c0e81e0aa..7e63865cc 100644
--- a/data/templates/ipsec/swanctl/l2tp.tmpl
+++ b/data/templates/ipsec/swanctl/l2tp.j2
@@ -1,6 +1,6 @@
 {% macro conn(l2tp, l2tp_outside_address, l2tp_ike_default, l2tp_esp_default, ike_group, esp_group) %}
-{%   set l2tp_ike = ike_group[l2tp.ike_group] if l2tp.ike_group is vyos_defined else None %}
-{%   set l2tp_esp = esp_group[l2tp.esp_group] if l2tp.esp_group is vyos_defined else None %}
+{% set l2tp_ike = ike_group[l2tp.ike_group] if l2tp.ike_group is vyos_defined else None %}
+{% set l2tp_esp = esp_group[l2tp.esp_group] if l2tp.esp_group is vyos_defined else None %}
     l2tp_remote_access {
         proposals = {{ l2tp_ike | get_esp_ike_cipher | join(',') if l2tp_ike else l2tp_ike_default }}
         local_addrs = {{ l2tp_outside_address }}
@@ -10,9 +10,9 @@
         reauth_time = 0
         local {
             auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
-{%   if l2tp.authentication.mode == 'x509' %}
+{% if l2tp.authentication.mode == 'x509' %}
             certs = {{ l2tp.authentication.x509.certificate }}.pem
-{%   endif %}
+{% endif %}
         }
         remote {
             auth = {{ 'psk' if l2tp.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
diff --git a/data/templates/ipsec/swanctl/peer.tmpl b/data/templates/ipsec/swanctl/peer.j2
index b21dce9f0..90d2c774f 100644
--- a/data/templates/ipsec/swanctl/peer.tmpl
+++ b/data/templates/ipsec/swanctl/peer.j2
@@ -1,78 +1,78 @@
 {% macro conn(peer, peer_conf, ike_group, esp_group) %}
-{%   set name = peer.replace("@", "") | dot_colon_to_dash %}
-{#   peer needs to reference the global IKE configuration for certain values #}
-{%   set ike = ike_group[peer_conf.ike_group] %}
+{% set name = peer.replace("@", "") | dot_colon_to_dash %}
+{# peer needs to reference the global IKE configuration for certain values #}
+{% set ike = ike_group[peer_conf.ike_group] %}
     peer_{{ name }} {
         proposals = {{ ike | get_esp_ike_cipher | join(',') }}
         version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
-{%   if peer_conf.virtual_address is vyos_defined %}
+{% if peer_conf.virtual_address is vyos_defined %}
         vips = {{ peer_conf.virtual_address | join(', ') }}
-{%   endif %}
+{% endif %}
         local_addrs = {{ peer_conf.local_address if peer_conf.local_address != 'any' else '0.0.0.0/0' }} # dhcp:{{ peer_conf.dhcp_interface if 'dhcp_interface' in peer_conf else 'no' }}
         remote_addrs = {{ peer if peer not in ['any', '0.0.0.0'] and peer[0:1] != '@' else '0.0.0.0/0' }}
-{%   if peer_conf.authentication.mode is vyos_defined('x509') %}
+{% if peer_conf.authentication.mode is vyos_defined('x509') %}
         send_cert = always
-{%   endif %}
-{%   if ike.dead_peer_detection is vyos_defined %}
+{% endif %}
+{% if ike.dead_peer_detection is vyos_defined %}
         dpd_timeout = {{ ike.dead_peer_detection.timeout }}
         dpd_delay = {{ ike.dead_peer_detection.interval }}
-{%   endif %}
-{%   if ike.key_exchange is vyos_defined('ikev1') and ike.mode is vyos_defined('aggressive') %}
+{% endif %}
+{% if ike.key_exchange is vyos_defined('ikev1') and ike.mode is vyos_defined('aggressive') %}
         aggressive = yes
-{%   endif %}
+{% endif %}
         rekey_time = {{ ike.lifetime }}s
         mobike = {{ "yes" if ike.mobike is not defined or ike.mobike == "enable" else "no" }}
-{%   if peer[0:1] == '@' %}
+{% if peer[0:1] == '@' %}
         keyingtries = 0
         reauth_time = 0
-{%   elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
+{% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
         keyingtries = 0
-{%   elif peer_conf.connection_type is vyos_defined('respond') %}
+{% elif peer_conf.connection_type is vyos_defined('respond') %}
         keyingtries = 1
-{%   endif %}
-{%   if peer_conf.force_encapsulation is vyos_defined('enable') %}
+{% endif %}
+{% if peer_conf.force_encapsulation is vyos_defined('enable') %}
         encap = yes
-{%   endif %}
+{% endif %}
         local {
-{%   if peer_conf.authentication.id is vyos_defined %}
+{% if peer_conf.authentication.id is vyos_defined %}
             id = "{{ peer_conf.authentication.id }}"
-{%   endif %}
+{% endif %}
             auth = {{ 'psk' if peer_conf.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
-{%   if peer_conf.authentication.mode == 'x509' %}
+{% if peer_conf.authentication.mode == 'x509' %}
             certs = {{ peer_conf.authentication.x509.certificate }}.pem
-{%   elif peer_conf.authentication.mode == 'rsa' %}
+{% elif peer_conf.authentication.mode == 'rsa' %}
             pubkeys = {{ peer_conf.authentication.rsa.local_key }}.pem
-{%   endif %}
+{% endif %}
         }
         remote {
-{%   if peer_conf.authentication.remote_id is vyos_defined %}
+{% if peer_conf.authentication.remote_id is vyos_defined %}
             id = "{{ peer_conf.authentication.remote_id }}"
-{%   else %}
+{% else %}
             id = "{{ peer }}"
-{%   endif %}
+{% endif %}
             auth = {{ 'psk' if peer_conf.authentication.mode == 'pre-shared-secret' else 'pubkey' }}
-{%   if peer_conf.authentication.mode == 'rsa' %}
+{% if peer_conf.authentication.mode == 'rsa' %}
             pubkeys = {{ peer_conf.authentication.rsa.remote_key }}.pem
-{%   endif %}
+{% endif %}
         }
         children {
-{%   if peer_conf.vti.bind is vyos_defined and peer_conf.tunnel is not vyos_defined %}
+{% if peer_conf.vti.bind is vyos_defined and peer_conf.tunnel is not vyos_defined %}
 {%     set vti_esp = esp_group[ peer_conf.vti.esp_group ] if peer_conf.vti.esp_group is vyos_defined else esp_group[ peer_conf.default_esp_group ] %}
             peer_{{ name }}_vti {
                 esp_proposals = {{ vti_esp | get_esp_ike_cipher(ike) | join(',') }}
-{%   if vti_esp.life_bytes is vyos_defined %}
+{%     if vti_esp.life_bytes is vyos_defined %}
                 life_bytes = {{ vti_esp.life_bytes }}
-{%   endif %}
-{%   if vti_esp.life_packets is vyos_defined %}
+{%     endif %}
+{%     if vti_esp.life_packets is vyos_defined %}
                 life_packets = {{ vti_esp.life_packets }}
-{%   endif %}
+{%     endif %}
                 life_time = {{ vti_esp.lifetime }}s
                 local_ts = 0.0.0.0/0,::/0
                 remote_ts = 0.0.0.0/0,::/0
                 updown = "/etc/ipsec.d/vti-up-down {{ peer_conf.vti.bind }}"
-                {# The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #}
-                {# Thus we simply shift the key by one to also support a vti0 interface #}
-{%              set if_id = peer_conf.vti.bind | replace('vti', '') | int +1 %}
+{#              The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #}
+{#              Thus we simply shift the key by one to also support a vti0 interface #}
+{%     set if_id = peer_conf.vti.bind | replace('vti', '') | int + 1 %}
                 if_id_in = {{ if_id }}
                 if_id_out = {{ if_id }}
                 ipcomp = {{ 'yes' if vti_esp.compression is vyos_defined('enable') else 'no' }}
@@ -87,80 +87,80 @@
                 start_action = none
 {%     endif %}
 {%     if ike.dead_peer_detection is vyos_defined %}
-{%       set dpd_translate = {'clear': 'clear', 'hold': 'trap', 'restart': 'restart'} %}
+{%         set dpd_translate = {'clear': 'clear', 'hold': 'trap', 'restart': 'restart'} %}
                 dpd_action = {{ dpd_translate[ike.dead_peer_detection.action] }}
 {%     endif %}
                 close_action = {{ {'none': 'none', 'hold': 'trap', 'restart': 'start'}[ike.close_action] }}
             }
-{%   elif peer_conf.tunnel is vyos_defined %}
+{% elif peer_conf.tunnel is vyos_defined %}
 {%     for tunnel_id, tunnel_conf in peer_conf.tunnel.items() if tunnel_conf.disable is not defined %}
-{%       set tunnel_esp_name = tunnel_conf.esp_group if tunnel_conf.esp_group is vyos_defined else peer_conf.default_esp_group %}
-{%       set tunnel_esp = esp_group[tunnel_esp_name] %}
-{%       set proto = tunnel_conf.protocol if tunnel_conf.protocol is vyos_defined else '' %}
-{%       set local_port = tunnel_conf.local.port if tunnel_conf.local.port is vyos_defined else '' %}
-{%       set local_suffix = '[{0}/{1}]'.format(proto, local_port) if proto or local_port else '' %}
-{%       set remote_port = tunnel_conf.remote.port if tunnel_conf.remote.port is vyos_defined else '' %}
-{%       set remote_suffix = '[{0}/{1}]'.format(proto, remote_port) if proto or remote_port else '' %}
+{%         set tunnel_esp_name = tunnel_conf.esp_group if tunnel_conf.esp_group is vyos_defined else peer_conf.default_esp_group %}
+{%         set tunnel_esp = esp_group[tunnel_esp_name] %}
+{%         set proto = tunnel_conf.protocol if tunnel_conf.protocol is vyos_defined else '' %}
+{%         set local_port = tunnel_conf.local.port if tunnel_conf.local.port is vyos_defined else '' %}
+{%         set local_suffix = '[{0}/{1}]'.format(proto, local_port) if proto or local_port else '' %}
+{%         set remote_port = tunnel_conf.remote.port if tunnel_conf.remote.port is vyos_defined else '' %}
+{%         set remote_suffix = '[{0}/{1}]'.format(proto, remote_port) if proto or remote_port else '' %}
             peer_{{ name }}_tunnel_{{ tunnel_id }} {
                 esp_proposals = {{ tunnel_esp | get_esp_ike_cipher(ike) | join(',') }}
-{%       if tunnel_esp.life_bytes is vyos_defined %}
+{%         if tunnel_esp.life_bytes is vyos_defined %}
                 life_bytes = {{ tunnel_esp.life_bytes }}
-{%       endif %}
-{%       if tunnel_esp.life_packets is vyos_defined %}
+{%         endif %}
+{%         if tunnel_esp.life_packets is vyos_defined %}
                 life_packets = {{ tunnel_esp.life_packets }}
-{%       endif %}
+{%         endif %}
                 life_time = {{ tunnel_esp.lifetime }}s
-{%       if tunnel_esp.mode is not defined or tunnel_esp.mode == 'tunnel' %}
-{%         if tunnel_conf.local.prefix is vyos_defined %}
-{%           set local_prefix = tunnel_conf.local.prefix if 'any' not in tunnel_conf.local.prefix else ['0.0.0.0/0', '::/0'] %}
+{%         if tunnel_esp.mode is not defined or tunnel_esp.mode == 'tunnel' %}
+{%             if tunnel_conf.local.prefix is vyos_defined %}
+{%                 set local_prefix = tunnel_conf.local.prefix if 'any' not in tunnel_conf.local.prefix else ['0.0.0.0/0', '::/0'] %}
                 local_ts = {{ local_prefix | join(local_suffix + ",") }}{{ local_suffix }}
-{%         endif %}
-{%         if tunnel_conf.remote.prefix is vyos_defined %}
-{%           set remote_prefix = tunnel_conf.remote.prefix if 'any' not in tunnel_conf.remote.prefix else ['0.0.0.0/0', '::/0'] %}
+{%             endif %}
+{%             if tunnel_conf.remote.prefix is vyos_defined %}
+{%                 set remote_prefix = tunnel_conf.remote.prefix if 'any' not in tunnel_conf.remote.prefix else ['0.0.0.0/0', '::/0'] %}
                 remote_ts = {{ remote_prefix | join(remote_suffix + ",") }}{{ remote_suffix }}
-{%         endif %}
-{%         if tunnel_conf.priority is vyos_defined %}
+{%             endif %}
+{%             if tunnel_conf.priority is vyos_defined %}
                 priority = {{ tunnel_conf.priority }}
-{%         endif %}
-{%       elif tunnel_esp.mode == 'transport' %}
+{%             endif %}
+{%         elif tunnel_esp.mode == 'transport' %}
                 local_ts = {{ peer_conf.local_address }}{{ local_suffix }}
                 remote_ts = {{ peer }}{{ remote_suffix }}
-{%       endif %}
+{%         endif %}
                 ipcomp = {{ 'yes' if tunnel_esp.compression is vyos_defined('enable') else 'no' }}
                 mode = {{ tunnel_esp.mode }}
-{%       if peer[0:1] == '@' %}
+{%         if peer[0:1] == '@' %}
                 start_action = none
-{%       elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
+{%         elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %}
                 start_action = start
-{%       elif peer_conf.connection_type is vyos_defined('respond') %}
+{%         elif peer_conf.connection_type is vyos_defined('respond') %}
                 start_action = trap
-{%       elif peer_conf.connection_type is vyos_defined('none') %}
+{%         elif peer_conf.connection_type is vyos_defined('none') %}
                 start_action = none
-{%       endif %}
-{%       if ike.dead_peer_detection is vyos_defined %}
-{%         set dpd_translate = {'clear': 'clear', 'hold': 'trap', 'restart': 'restart'} %}
+{%         endif %}
+{%         if ike.dead_peer_detection is vyos_defined %}
+{%             set dpd_translate = {'clear': 'clear', 'hold': 'trap', 'restart': 'restart'} %}
                 dpd_action = {{ dpd_translate[ike.dead_peer_detection.action] }}
-{%       endif %}
+{%         endif %}
                 close_action = {{ {'none': 'none', 'hold': 'trap', 'restart': 'start'}[ike.close_action] }}
-{%       if peer_conf.vti.bind is vyos_defined %}
+{%         if peer_conf.vti.bind is vyos_defined %}
+{#             The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #}
+{#             Thus we simply shift the key by one to also support a vti0 interface #}
+{%             set if_id = peer_conf.vti.bind | replace('vti', '') | int + 1 %}
                 updown = "/etc/ipsec.d/vti-up-down {{ peer_conf.vti.bind }}"
-                {# The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #}
-                {# Thus we simply shift the key by one to also support a vti0 interface #}
-{%              set if_id = peer_conf.vti.bind | replace('vti', '') | int +1 %}
                 if_id_in = {{ if_id }}
                 if_id_out = {{ if_id }}
-{%       endif %}
+{%         endif %}
             }
-{%       if tunnel_conf.passthrough is vyos_defined %}
-            peer_{{ name }}_tunnel_{{ tunnel_id }}_passthough {
+{%         if tunnel_conf.passthrough is vyos_defined %}
+            peer_{{ name }}_tunnel_{{ tunnel_id }}_passthrough {
                 local_ts = {{ tunnel_conf.passthrough | join(",") }}
                 remote_ts = {{ tunnel_conf.passthrough | join(",") }}
                 start_action = trap
                 mode = pass
             }
-{%       endif %}
+{%         endif %}
 {%     endfor %}
-{%   endif %}
+{% endif %}
         }
     }
 {% endmacro %}
diff --git a/data/templates/ipsec/swanctl/profile.tmpl b/data/templates/ipsec/swanctl/profile.j2
index 0f1c2fda2..d4f417378 100644
--- a/data/templates/ipsec/swanctl/profile.tmpl
+++ b/data/templates/ipsec/swanctl/profile.j2
@@ -1,39 +1,39 @@
 {% macro conn(name, profile_conf, ike_group, esp_group) %}
-{#   peer needs to reference the global IKE configuration for certain values #}
-{%   set ike = ike_group[profile_conf.ike_group] %}
-{%   set esp = esp_group[profile_conf.esp_group] %}
-{%   if profile_conf.bind.tunnel is vyos_defined %}
+{# peer needs to reference the global IKE configuration for certain values #}
+{% set ike = ike_group[profile_conf.ike_group] %}
+{% set esp = esp_group[profile_conf.esp_group] %}
+{% if profile_conf.bind.tunnel is vyos_defined %}
 {%     for interface in profile_conf.bind.tunnel %}
     dmvpn-{{ name }}-{{ interface }} {
         proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }}
         version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
         rekey_time = {{ ike.lifetime }}s
         keyingtries = 0
-{%       if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
+{%         if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
         local {
             auth = psk
         }
         remote {
             auth = psk
         }
-{%       endif %}
+{%         endif %}
         children {
             dmvpn {
-                esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',')  }}
+                esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }}
                 rekey_time = {{ esp.lifetime }}s
                 rand_time = 540s
                 local_ts = dynamic[gre]
                 remote_ts = dynamic[gre]
                 mode = {{ esp.mode }}
-{%       if ike.dead_peer_detection.action is vyos_defined %}
+{%         if ike.dead_peer_detection.action is vyos_defined %}
                 dpd_action = {{ ike.dead_peer_detection.action }}
-{%       endif %}
-{%       if esp.compression is vyos_defined('enable') %}
+{%         endif %}
+{%         if esp.compression is vyos_defined('enable') %}
                 ipcomp = yes
-{%       endif %}
+{%         endif %}
             }
         }
     }
 {%     endfor %}
-{%   endif %}
+{% endif %}
 {% endmacro %}
diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.j2
index 059984139..d2760ec1f 100644
--- a/data/templates/ipsec/swanctl/remote_access.tmpl
+++ b/data/templates/ipsec/swanctl/remote_access.j2
@@ -1,7 +1,7 @@
 {% macro conn(name, rw_conf, ike_group, esp_group) %}
-{#   peer needs to reference the global IKE configuration for certain values #}
-{%   set ike = ike_group[rw_conf.ike_group] %}
-{%   set esp = esp_group[rw_conf.esp_group] %}
+{# peer needs to reference the global IKE configuration for certain values #}
+{% set ike = ike_group[rw_conf.ike_group] %}
+{% set esp = esp_group[rw_conf.esp_group] %}
     ra-{{ name }} {
         remote_addrs = %any
         local_addrs = {{ rw_conf.local_address if rw_conf.local_address is vyos_defined else '%any' }}
@@ -10,28 +10,29 @@
         send_certreq = no
         rekey_time = {{ ike.lifetime }}s
         keyingtries = 0
-{%   if rw_conf.unique is vyos_defined %}
+{% if rw_conf.unique is vyos_defined %}
         unique = {{ rw_conf.unique }}
-{%   endif %}
-{%   if rw_conf.pool is vyos_defined %}
+{% endif %}
+{% if rw_conf.pool is vyos_defined %}
         pools = {{ rw_conf.pool | join(',') }}
-{%   endif %}
+{% endif %}
         local {
-{%   if rw_conf.authentication.id is vyos_defined and rw_conf.authentication.use_x509_id is not vyos_defined %}
-            id = '{{ rw_conf.authentication.id }}'
-{%   endif %}
-{%   if rw_conf.authentication.server_mode == 'x509' %}
+{% if rw_conf.authentication.id is vyos_defined and rw_conf.authentication.use_x509_id is not vyos_defined %}
+{#          please use " quotes - else Apple iOS goes crazy #}
+            id = "{{ rw_conf.authentication.id }}"
+{% endif %}
+{% if rw_conf.authentication.server_mode == 'x509' %}
             auth = pubkey
             certs = {{ rw_conf.authentication.x509.certificate }}.pem
-{%   elif rw_conf.authentication.server_mode == 'pre-shared-secret' %}
+{% elif rw_conf.authentication.server_mode == 'pre-shared-secret' %}
             auth = psk
-{%   endif %}
+{% endif %}
         }
         remote {
             auth = {{ rw_conf.authentication.client_mode }}
-{%   if rw_conf.authentication.client_mode.startswith("eap") %}
+{% if rw_conf.authentication.client_mode.startswith("eap") %}
             eap_id = %any
-{%   endif %}
+{% endif %}
         }
         children {
             ikev2-vpn  {
@@ -40,9 +41,9 @@
                 rand_time = 540s
                 dpd_action = clear
                 inactivity = {{ rw_conf.timeout }}
-{%   set local_prefix = rw_conf.local.prefix if rw_conf.local.prefix is vyos_defined else ['0.0.0.0/0', '::/0'] %}
-{%   set local_port = rw_conf.local.port if rw_conf.local.port is vyos_defined else '' %}
-{%   set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %}
+{% set local_prefix = rw_conf.local.prefix if rw_conf.local.prefix is vyos_defined else ['0.0.0.0/0', '::/0'] %}
+{% set local_port = rw_conf.local.port if rw_conf.local.port is vyos_defined else '' %}
+{% set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %}
                 local_ts = {{ local_prefix | join(local_suffix + ",") }}{{ local_suffix }}
             }
         }
diff --git a/data/templates/ipsec/windows_profile.tmpl b/data/templates/ipsec/windows_profile.j2
index 8c26944be..8c26944be 100644
--- a/data/templates/ipsec/windows_profile.tmpl
+++ b/data/templates/ipsec/windows_profile.j2
diff --git a/data/templates/lcd/LCDd.conf.tmpl b/data/templates/lcd/LCDd.conf.j2
index 2c8c6602d..3631add1d 100644
--- a/data/templates/lcd/LCDd.conf.tmpl
+++ b/data/templates/lcd/LCDd.conf.j2
@@ -49,13 +49,13 @@ DriverPath=/usr/lib/x86_64-linux-gnu/lcdproc/
 #   text, tyan, ula200, vlsys_m428, xosd, yard2LCD
 
 {% if model is vyos_defined %}
-{%   if model.startswith('cfa-') %}
+{%     if model.startswith('cfa-') %}
 Driver=CFontzPacket
-{%   elif model == 'sdec' %}
+{%     elif model == 'sdec' %}
 Driver=sdeclcd
-{%   elif model == 'hd44780' %}
+{%     elif model == 'hd44780' %}
 Driver=hd44780
-{%   endif %}
+{%     endif %}
 {% endif %}
 
 # Tells the driver to bind to the given interface. [default: 127.0.0.1]
@@ -116,7 +116,7 @@ Heartbeat=off
 TitleSpeed=10
 
 {% if model is vyos_defined %}
-{%   if model.startswith('cfa-') %}
+{%     if model.startswith('cfa-') %}
 ## CrystalFontz packet driver (for CFA533, CFA631, CFA633 & CFA635) ##
 [CFontzPacket]
 Model={{ model.split('-')[1] }}
@@ -126,14 +126,14 @@ Brightness=500
 OffBrightness=50
 Reboot=yes
 USB=yes
-{%   elif model == 'sdec' %}
+{%     elif model == 'sdec' %}
 ## SDEC driver for Lanner, Watchguard, Sophos sppliances ##
 [sdeclcd]
 # No options
-{%   elif model == 'hd44780' %}
+{%     elif model == 'hd44780' %}
 [hd44780]
 ConnectionType=ezio
 Device={{ device }}
 Size=16x2
-{%   endif %}
+{%     endif %}
 {% endif %}
diff --git a/data/templates/lcd/lcdproc.conf.tmpl b/data/templates/lcd/lcdproc.conf.j2
index c79f3cd0d..c79f3cd0d 100644
--- a/data/templates/lcd/lcdproc.conf.tmpl
+++ b/data/templates/lcd/lcdproc.conf.j2
diff --git a/data/templates/lldp/lldpd.j2 b/data/templates/lldp/lldpd.j2
new file mode 100644
index 000000000..3c499197d
--- /dev/null
+++ b/data/templates/lldp/lldpd.j2
@@ -0,0 +1,2 @@
+### Autogenerated by lldp.py ###
+DAEMON_ARGS="-M 4 {{ '-x' if snmp.enable is vyos_defined }} {{ '-c' if legacy_protocols.cdp is vyos_defined }} {{ '-e' if legacy_protocols.edp is vyos_defined }} {{ '-f' if legacy_protocols.fdp is vyos_defined }} {{ '-s' if legacy_protocols.sonmp is vyos_defined }}"
diff --git a/data/templates/lldp/lldpd.tmpl b/data/templates/lldp/lldpd.tmpl
deleted file mode 100644
index 9ab1e4367..000000000
--- a/data/templates/lldp/lldpd.tmpl
+++ /dev/null
@@ -1,2 +0,0 @@
-### Autogenerated by lldp.py ###
-DAEMON_ARGS="-M 4{% if snmp.enable is vyos_defined %} -x{% endif %}{% if legacy_protocols.cdp is vyos_defined %} -c{% endif %}{% if legacy_protocols.edp is vyos_defined %} -e{% endif %}{% if legacy_protocols.fdp is vyos_defined %} -f{% endif %}{% if legacy_protocols.sonmp is vyos_defined %} -s{% endif %}"
diff --git a/data/templates/lldp/vyos.conf.tmpl b/data/templates/lldp/vyos.conf.j2
index c34a851aa..ec84231d8 100644
--- a/data/templates/lldp/vyos.conf.tmpl
+++ b/data/templates/lldp/vyos.conf.j2
@@ -3,21 +3,21 @@
 configure system platform VyOS
 configure system description "VyOS {{ version }}"
 {% if interface is vyos_defined %}
-{%   set tmp = [] %}
-{%   for iface, iface_options in interface.items() if not iface_options.disable %}
-{%     if iface == 'all' %}
-{%       set iface = '*' %}
-{%     endif %}
-{%     set _ = tmp.append(iface) %}
-{%     if iface_options.location is vyos_defined %}
-{%       if iface_options.location.elin is vyos_defined %}
+{%     set tmp = [] %}
+{%     for iface, iface_options in interface.items() if not iface_options.disable %}
+{%         if iface == 'all' %}
+{%             set iface = '*' %}
+{%         endif %}
+{%         set _ = tmp.append(iface) %}
+{%         if iface_options.location is vyos_defined %}
+{%             if iface_options.location.elin is vyos_defined %}
 configure ports {{ iface }} med location elin "{{ iface_options.location.elin }}"
-{%       endif %}
-{%       if iface_options.location.coordinate_based is vyos_defined %}
+{%             endif %}
+{%             if iface_options.location.coordinate_based is vyos_defined %}
 configure ports {{ iface }} med location coordinate latitude "{{ iface_options.location.coordinate_based.latitude }}" longitude "{{ iface_options.location.coordinate_based.longitude }}" altitude "{{ iface_options.location.coordinate_based.altitude }}m" datum "{{ iface_options.location.coordinate_based.datum }}"
-{%       endif %}
-{%     endif %}
-{%   endfor %}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
 configure system interface pattern "{{ tmp | join(",") }}"
 {% endif %}
 {% if management_address is vyos_defined %}
diff --git a/data/templates/login/authorized_keys.tmpl b/data/templates/login/authorized_keys.j2
index 9402c8719..aabca47cf 100644
--- a/data/templates/login/authorized_keys.tmpl
+++ b/data/templates/login/authorized_keys.j2
@@ -1,9 +1,9 @@
 ### Automatically generated by system-login.py ###
 
 {% if authentication.public_keys is vyos_defined %}
-{%   for key, key_options in authentication.public_keys.items() %}
+{%     for key, key_options in authentication.public_keys.items() %}
 {# The whitespace after options is wisely chosen #}
 {{ key_options.options ~ ' ' if key_options.options is vyos_defined }}{{ key_options.type }} {{ key_options.key }} {{ key }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
diff --git a/data/templates/login/pam_radius_auth.conf.j2 b/data/templates/login/pam_radius_auth.conf.j2
new file mode 100644
index 000000000..1105b60e5
--- /dev/null
+++ b/data/templates/login/pam_radius_auth.conf.j2
@@ -0,0 +1,36 @@
+# Automatically generated by system-login.py
+# RADIUS configuration file
+
+{% if radius is vyos_defined %}
+{#     RADIUS IPv6 source address must be specified in [] notation #}
+{%     set source_address = namespace()  %}
+{%     if radius.source_address is vyos_defined %}
+{%         for address in radius.source_address %}
+{%             if address | is_ipv4 %}
+{%                 set source_address.ipv4 = address %}
+{%             elif address | is_ipv6 %}
+{%                 set source_address.ipv6 = "[" + address + "]" %}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+{%     if radius.server is vyos_defined %}
+# server[:port]        shared_secret             timeout    source_ip
+{# .items() returns a tuple of two elements: key and value. 1 relates to the 2nd element i.e. the value and .priority relates to the key from the internal dict #}
+{%         for server, options in radius.server.items() | sort(attribute='1.priority') if not options.disabled %}
+{#         RADIUS IPv6 servers must be specified in [] notation #}
+{%             if server | is_ipv4 %}
+{{ server }}:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv4 if source_address.ipv4 is vyos_defined }}
+{%             else %}
+[{{ server }}]:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv6 if source_address.ipv6 is vyos_defined }}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+
+priv-lvl 15
+mapped_priv_user radius_priv_user
+
+{%     if radius.vrf is vyos_defined %}
+vrf-name {{ radius.vrf }}
+{%     endif %}
+{% endif %}
+
diff --git a/data/templates/login/pam_radius_auth.conf.tmpl b/data/templates/login/pam_radius_auth.conf.tmpl
deleted file mode 100644
index 4e34ade41..000000000
--- a/data/templates/login/pam_radius_auth.conf.tmpl
+++ /dev/null
@@ -1,36 +0,0 @@
-# Automatically generated by system-login.py
-# RADIUS configuration file
-
-{% if radius is vyos_defined %}
-{#   RADIUS IPv6 source address must be specified in [] notation #}
-{%   set source_address = namespace()  %}
-{%   if radius.source_address is vyos_defined %}
-{%     for address in radius.source_address %}
-{%       if address | is_ipv4 %}
-{%         set source_address.ipv4 = address %}
-{%       elif address | is_ipv6 %}
-{%         set source_address.ipv6 = "[" + address + "]" %}
-{%       endif %}
-{%     endfor %}
-{%   endif %}
-{% if radius.server is vyos_defined %}
-# server[:port]        shared_secret             timeout    source_ip
-{# .items() returns a tuple of two elements: key and value. 1 relates to the 2nd element i.e. the value and .priority relates to the key from the internal dict #}
-{%   for server, options in radius.server.items() | sort(attribute='1.priority') if not options.disabled %}
-{#   RADIUS IPv6 servers must be specified in [] notation #}
-{%     if server | is_ipv4 %}
-{{ server }}:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv4 if source_address.ipv4 is vyos_defined }}
-{%     else %}
-[{{ server }}]:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv6 if source_address.ipv6 is vyos_defined }}
-{%     endif %}
-{%   endfor %}
-{% endif %}
-
-priv-lvl 15
-mapped_priv_user radius_priv_user
-
-{%   if radius.vrf is vyos_defined %}
-vrf-name {{ radius.vrf }}
-{%   endif %}
-{% endif %}
-
diff --git a/data/templates/logs/logrotate/vyos-atop.tmpl b/data/templates/logs/logrotate/vyos-atop.j2
index 2d078f379..2d078f379 100644
--- a/data/templates/logs/logrotate/vyos-atop.tmpl
+++ b/data/templates/logs/logrotate/vyos-atop.j2
diff --git a/data/templates/logs/logrotate/vyos-rsyslog.tmpl b/data/templates/logs/logrotate/vyos-rsyslog.j2
index f2e4d2ab2..f2e4d2ab2 100644
--- a/data/templates/logs/logrotate/vyos-rsyslog.tmpl
+++ b/data/templates/logs/logrotate/vyos-rsyslog.j2
diff --git a/data/templates/mdns-repeater/avahi-daemon.tmpl b/data/templates/mdns-repeater/avahi-daemon.j2
index 65bb5a306..65bb5a306 100644
--- a/data/templates/mdns-repeater/avahi-daemon.tmpl
+++ b/data/templates/mdns-repeater/avahi-daemon.j2
diff --git a/data/templates/monitoring/override.conf.tmpl b/data/templates/monitoring/override.conf.j2
index f8f150791..f8f150791 100644
--- a/data/templates/monitoring/override.conf.tmpl
+++ b/data/templates/monitoring/override.conf.j2
diff --git a/data/templates/monitoring/syslog_telegraf.tmpl b/data/templates/monitoring/syslog_telegraf.j2
index cdcbd92a4..cdcbd92a4 100644
--- a/data/templates/monitoring/syslog_telegraf.tmpl
+++ b/data/templates/monitoring/syslog_telegraf.j2
diff --git a/data/templates/monitoring/systemd_vyos_telegraf_service.tmpl b/data/templates/monitoring/systemd_vyos_telegraf_service.j2
index 234ef5586..234ef5586 100644
--- a/data/templates/monitoring/systemd_vyos_telegraf_service.tmpl
+++ b/data/templates/monitoring/systemd_vyos_telegraf_service.j2
diff --git a/data/templates/monitoring/telegraf.j2 b/data/templates/monitoring/telegraf.j2
new file mode 100644
index 000000000..d1a94366b
--- /dev/null
+++ b/data/templates/monitoring/telegraf.j2
@@ -0,0 +1,105 @@
+# Generated by /usr/libexec/vyos/conf_mode/service_monitoring_telegraf.py
+
+[agent]
+  interval = "15s"
+  round_interval = true
+  metric_batch_size = 1000
+  metric_buffer_limit = 10000
+  collection_jitter = "5s"
+  flush_interval = "15s"
+  flush_jitter = "0s"
+  precision = ""
+  debug = false
+  quiet = false
+  logfile = ""
+  hostname = ""
+  omit_hostname = false
+{% if influxdb_configured is vyos_defined %}
+### InfluxDB2 ###
+[[outputs.influxdb_v2]]
+  urls = ["{{ url }}:{{ port }}"]
+  insecure_skip_verify = true
+  token = "$INFLUX_TOKEN"
+  organization = "{{ authentication.organization }}"
+  bucket = "{{ bucket }}"
+### End InfluxDB2 ###
+{% endif %}
+{% if prometheus_client is vyos_defined %}
+### Prometheus ###
+[[outputs.prometheus_client]]
+  ## Address to listen on
+  listen = "{{ prometheus_client.listen_address if prometheus_client.listen_address is vyos_defined else '' }}:{{ prometheus_client.port }}"
+  metric_version = {{ prometheus_client.metric_version }}
+{%     if prometheus_client.authentication.username is vyos_defined and prometheus_client.authentication.password is vyos_defined  %}
+  ## Use HTTP Basic Authentication
+  basic_username = "{{ prometheus_client.authentication.username }}"
+  basic_password = "{{ prometheus_client.authentication.password }}"
+{%     endif %}
+{%     if prometheus_client.allow_from is vyos_defined %}
+  ip_range = {{ prometheus_client.allow_from }}
+{%     endif %}
+### End Prometheus ###
+{% endif %}
+{% if splunk is vyos_defined %}
+### Splunk ###
+[[outputs.http]]
+  ## URL is the address to send metrics to
+  url = "{{ splunk.url }}"
+  ## Timeout for HTTP message
+  # timeout = "5s"
+  ## Use TLS but skip chain & host verification
+{%     if splunk.authentication.insecure is vyos_defined %}
+  insecure_skip_verify = true
+{%     endif %}
+  ## Data format to output
+  data_format = "splunkmetric"
+  ## Provides time, index, source overrides for the HEC
+  splunkmetric_hec_routing = true
+  ## Additional HTTP headers
+   [outputs.http.headers]
+   # Should be set manually to "application/json" for json data_format
+     Content-Type = "application/json"
+     Authorization = "Splunk {{ splunk.authentication.token }}"
+     X-Splunk-Request-Channel = "{{ splunk.authentication.token }}"
+### End Splunk ###
+{% endif %}
+[[inputs.cpu]]
+    percpu = true
+    totalcpu = true
+    collect_cpu_time = false
+    report_active = false
+[[inputs.disk]]
+    ignore_fs = ["devtmpfs", "devfs"]
+[[inputs.diskio]]
+[[inputs.mem]]
+[[inputs.net]]
+[[inputs.system]]
+[[inputs.netstat]]
+[[inputs.processes]]
+[[inputs.kernel]]
+[[inputs.interrupts]]
+[[inputs.linux_sysctl_fs]]
+[[inputs.systemd_units]]
+[[inputs.conntrack]]
+  files = ["ip_conntrack_count","ip_conntrack_max","nf_conntrack_count","nf_conntrack_max"]
+  dirs = ["/proc/sys/net/ipv4/netfilter","/proc/sys/net/netfilter"]
+[[inputs.ethtool]]
+  interface_include = {{ interfaces_ethernet }}
+[[inputs.ntpq]]
+  dns_lookup = true
+[[inputs.internal]]
+[[inputs.nstat]]
+[[inputs.syslog]]
+  server = "unixgram:///run/telegraf/telegraf_syslog.sock"
+  best_effort = true
+  syslog_standard = "RFC3164"
+{% if influxdb_configured is vyos_defined %}
+[[inputs.exec]]
+  commands = [
+    "{{ custom_scripts_dir }}/show_firewall_input_filter.py",
+    "{{ custom_scripts_dir }}/show_interfaces_input_filter.py",
+    "{{ custom_scripts_dir }}/vyos_services_input_filter.py"
+  ]
+  timeout = "10s"
+  data_format = "influx"
+{% endif %}
diff --git a/data/templates/monitoring/telegraf.tmpl b/data/templates/monitoring/telegraf.tmpl
deleted file mode 100644
index d3145a500..000000000
--- a/data/templates/monitoring/telegraf.tmpl
+++ /dev/null
@@ -1,60 +0,0 @@
-# Generated by /usr/libexec/vyos/conf_mode/service_monitoring_telegraf.py
-
-[agent]
-  interval = "10s"
-  round_interval = true
-  metric_batch_size = 1000
-  metric_buffer_limit = 10000
-  collection_jitter = "0s"
-  flush_interval = "10s"
-  flush_jitter = "0s"
-  precision = ""
-  debug = false
-  quiet = false
-  logfile = ""
-  hostname = ""
-  omit_hostname = false
-[[outputs.influxdb_v2]]
-  urls = ["{{ url }}:{{ port }}"]
-  insecure_skip_verify = true
-  token = "$INFLUX_TOKEN"
-  organization = "{{ authentication.organization }}"
-  bucket = "{{ bucket }}"
-[[inputs.cpu]]
-    percpu = true
-    totalcpu = true
-    collect_cpu_time = false
-    report_active = false
-[[inputs.disk]]
-    ignore_fs = ["devtmpfs", "devfs"]
-[[inputs.diskio]]
-[[inputs.mem]]
-[[inputs.net]]
-[[inputs.system]]
-[[inputs.netstat]]
-[[inputs.processes]]
-[[inputs.kernel]]
-[[inputs.interrupts]]
-[[inputs.linux_sysctl_fs]]
-[[inputs.systemd_units]]
-[[inputs.conntrack]]
-  files = ["ip_conntrack_count","ip_conntrack_max","nf_conntrack_count","nf_conntrack_max"]
-  dirs = ["/proc/sys/net/ipv4/netfilter","/proc/sys/net/netfilter"]
-[[inputs.ethtool]]
-  interface_include = {{ interfaces_ethernet }}
-[[inputs.ntpq]]
-  dns_lookup = true
-[[inputs.internal]]
-[[inputs.nstat]]
-[[inputs.syslog]]
-  server = "unixgram:///run/telegraf/telegraf_syslog.sock"
-  best_effort = true
-  syslog_standard = "RFC3164"
-[[inputs.exec]]
-  commands = [
-    "{{ custom_scripts_dir }}/show_firewall_input_filter.py",
-    "{{ custom_scripts_dir }}/show_interfaces_input_filter.py",
-    "{{ custom_scripts_dir }}/vyos_services_input_filter.py"
-  ]
-  timeout = "10s"
-  data_format = "influx"
diff --git a/data/templates/ndppd/ndppd.conf.j2 b/data/templates/ndppd/ndppd.conf.j2
new file mode 100644
index 000000000..120fa0a64
--- /dev/null
+++ b/data/templates/ndppd/ndppd.conf.j2
@@ -0,0 +1,44 @@
+########################################################
+#
+# autogenerated by nat66.py
+#
+#   The configuration file must define one upstream
+#   interface.
+#
+#   For some services, such as nat66, because it runs
+#    stateless, it needs to rely on NDP Proxy to respond
+#   to NDP requests.
+#
+#   When using nat66 source rules, NDP Proxy needs
+#   to be enabled
+#
+########################################################
+
+{% set global = namespace(ndppd_interfaces = [],ndppd_prefixs = []) %}
+{% if source.rule is vyos_defined %}
+{%     for rule, config in source.rule.items() if config.disable is not defined %}
+{%         if config.outbound_interface is vyos_defined %}
+{%             if config.outbound_interface not in global.ndppd_interfaces %}
+{%                 set global.ndppd_interfaces = global.ndppd_interfaces + [config.outbound_interface] %}
+{%             endif   %}
+{%             if config.translation.address is vyos_defined and config.translation.address | is_ip_network %}
+{%                 set global.ndppd_prefixs = global.ndppd_prefixs + [{'interface':config.outbound_interface,'rule':config.translation.address}] %}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+
+{% for interface in global.ndppd_interfaces %}
+proxy {{ interface }} {
+    router yes
+    timeout 500
+    ttl 30000
+{%     for map in global.ndppd_prefixs %}
+{%         if map.interface == interface %}
+    rule {{ map.rule }} {
+        static
+    }
+{%         endif  %}
+{%     endfor   %}
+}
+{% endfor %}
diff --git a/data/templates/ndppd/ndppd.conf.tmpl b/data/templates/ndppd/ndppd.conf.tmpl
deleted file mode 100644
index c41392cc7..000000000
--- a/data/templates/ndppd/ndppd.conf.tmpl
+++ /dev/null
@@ -1,44 +0,0 @@
-########################################################
-#
-# autogenerated by nat66.py
-#
-#   The configuration file must define one upstream
-#   interface.
-#
-#   For some services, such as nat66, because it runs
-#    stateless, it needs to rely on NDP Proxy to respond
-#   to NDP requests.
-#
-#   When using nat66 source rules, NDP Proxy needs
-#   to be enabled
-#
-########################################################
-
-{% set global = namespace(ndppd_interfaces = [],ndppd_prefixs = []) %}
-{% if source.rule is vyos_defined %}
-{%   for rule, config in source.rule.items() if config.disable is not defined %}
-{%     if config.outbound_interface is vyos_defined %}
-{%         if config.outbound_interface not in global.ndppd_interfaces %}
-{%             set global.ndppd_interfaces = global.ndppd_interfaces + [config.outbound_interface] %}
-{%         endif   %}
-{%         if config.translation.address is vyos_defined and config.translation.address | is_ip_network %}
-{%             set global.ndppd_prefixs = global.ndppd_prefixs + [{'interface':config.outbound_interface,'rule':config.translation.address}] %}
-{%         endif    %}
-{%     endif    %}
-{%   endfor %}
-{% endif %}
-
-{% for interface in global.ndppd_interfaces %}
-proxy {{ interface }} {
-    router yes
-    timeout 500
-    ttl 30000
-{%  for map in global.ndppd_prefixs %}
-{%     if map.interface == interface %}
-    rule {{ map.rule }} {
-        static
-    }
-{%     endif  %}
-{%  endfor   %}
-}
-{% endfor %}
diff --git a/data/templates/nhrp/opennhrp.conf.j2 b/data/templates/nhrp/opennhrp.conf.j2
new file mode 100644
index 000000000..c040a8f14
--- /dev/null
+++ b/data/templates/nhrp/opennhrp.conf.j2
@@ -0,0 +1,42 @@
+{# j2lint: disable=jinja-variable-format #}
+# Created by VyOS - manual changes will be overwritten
+
+{% if tunnel is vyos_defined %}
+{%     for name, tunnel_conf in tunnel.items() %}
+{%         set type = 'spoke' if tunnel_conf.map is vyos_defined or tunnel_conf.dynamic_map is vyos_defined else 'hub' %}
+{%         set profile_name = profile_map[name] if profile_map is vyos_defined and name in profile_map else '' %}
+interface {{ name }} #{{ type }} {{ profile_name }}
+{%         if tunnel_conf.map is vyos_defined %}
+{%             for map, map_conf in tunnel_conf.map.items() %}
+{%                 set cisco = ' cisco' if map_conf.cisco is vyos_defined else '' %}
+{%                 set register = ' register' if map_conf.register is vyos_defined else '' %}
+    map {{ map }} {{ map_conf.nbma_address }}{{ register }}{{ cisco }}
+{%             endfor %}
+{%         endif %}
+{%         if tunnel_conf.dynamic_map is vyos_defined %}
+{%             for map, map_conf in tunnel_conf.dynamic_map.items() %}
+    dynamic-map {{ map }} {{ map_conf.nbma_domain_name }}
+{%             endfor %}
+{%         endif %}
+{%         if tunnel_conf.cisco_authentication is vyos_defined %}
+    cisco-authentication {{ tunnel_conf.cisco_authentication }}
+{%         endif %}
+{%         if tunnel_conf.holding_time is vyos_defined %}
+    holding-time {{ tunnel_conf.holding_time }}
+{%         endif %}
+{%         if tunnel_conf.multicast is vyos_defined %}
+    multicast {{ tunnel_conf.multicast }}
+{%         endif %}
+{%         for key in ['non_caching', 'redirect', 'shortcut', 'shortcut_destination'] %}
+{%             if key in tunnel_conf %}
+    {{ key | replace("_", "-") }}
+{%             endif %}
+{%         endfor %}
+{%         if tunnel_conf.shortcut_target is vyos_defined %}
+{%             for target, shortcut_conf in tunnel_conf.shortcut_target.items() %}
+    shortcut-target {{ target }}{{ ' holding-time ' + shortcut_conf.holding_time if shortcut_conf.holding_time is vyos_defined }}
+{%             endfor %}
+{%         endif %}
+
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/nhrp/opennhrp.conf.tmpl b/data/templates/nhrp/opennhrp.conf.tmpl
deleted file mode 100644
index 721d41e49..000000000
--- a/data/templates/nhrp/opennhrp.conf.tmpl
+++ /dev/null
@@ -1,41 +0,0 @@
-# Created by VyOS - manual changes will be overwritten
-
-{% if tunnel is vyos_defined %}
-{%   for name, tunnel_conf in tunnel.items() %}
-{%     set type = 'spoke' if tunnel_conf.map is vyos_defined or tunnel_conf.dynamic_map is vyos_defined else 'hub' %}
-{%     set profile_name = profile_map[name] if profile_map is vyos_defined and name in profile_map else '' %}
-interface {{ name }} #{{ type }} {{ profile_name }}
-{%     if tunnel_conf.map is vyos_defined %}
-{%       for map, map_conf in tunnel_conf.map.items() %}
-{%         set cisco = ' cisco' if map_conf.cisco is vyos_defined else '' %}
-{%         set register = ' register' if map_conf.register is vyos_defined else '' %}
-    map {{ map }} {{ map_conf.nbma_address }}{{ register }}{{ cisco }}
-{%       endfor %}
-{%     endif %}
-{%     if tunnel_conf.dynamic_map is vyos_defined %}
-{%       for map, map_conf in tunnel_conf.dynamic_map.items() %}
-    dynamic-map {{ map }} {{ map_conf.nbma_domain_name }}
-{%       endfor %}
-{%     endif %}
-{%     if tunnel_conf.cisco_authentication is vyos_defined %}
-    cisco-authentication {{ tunnel_conf.cisco_authentication }}
-{%     endif %}
-{%     if tunnel_conf.holding_time is vyos_defined %}
-    holding-time {{ tunnel_conf.holding_time }}
-{%     endif %}
-{%     if tunnel_conf.multicast is vyos_defined %}
-    multicast {{ tunnel_conf.multicast }}
-{%     endif %}
-{%     for key in ['non_caching', 'redirect', 'shortcut', 'shortcut_destination'] %}
-{%       if key in tunnel_conf %}
-    {{ key | replace("_", "-") }}
-{%       endif %}
-{%     endfor %}
-{%     if tunnel_conf.shortcut_target is vyos_defined %}
-{%       for target, shortcut_conf in tunnel_conf.shortcut_target.items() %}
-    shortcut-target {{ target }}{{ ' holding-time ' + shortcut_conf.holding_time if shortcut_conf.holding_time is vyos_defined }}
-{%       endfor %}
-{%     endif %}
-
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/ocserv/ocserv_config.tmpl b/data/templates/ocserv/ocserv_config.j2
index 05b85a610..8418a2185 100644
--- a/data/templates/ocserv/ocserv_config.tmpl
+++ b/data/templates/ocserv/ocserv_config.j2
@@ -9,13 +9,13 @@ run-as-group = daemon
 {% if "radius" in authentication.mode %}
 auth = "radius [config=/run/ocserv/radiusclient.conf]"
 {% elif "local" in authentication.mode %}
-{%   if authentication.mode.local == "password-otp" %}
+{%     if authentication.mode.local == "password-otp" %}
 auth = "plain[passwd=/run/ocserv/ocpasswd,otp=/run/ocserv/users.oath]"
-{%   elif authentication.mode.local == "otp" %}
+{%     elif authentication.mode.local == "otp" %}
 auth = "plain[otp=/run/ocserv/users.oath]"
-{%   else %}
+{%     else %}
 auth = "plain[/run/ocserv/ocpasswd]"
-{%   endif %}
+{%     endif %}
 {% else %}
 auth = "plain[/run/ocserv/ocpasswd]"
 {% endif %}
@@ -23,9 +23,9 @@ auth = "plain[/run/ocserv/ocpasswd]"
 {% if ssl.certificate is vyos_defined %}
 server-cert = /run/ocserv/cert.pem
 server-key = /run/ocserv/cert.key
-{% if ssl.passphrase is vyos_defined %}
+{%     if ssl.passphrase is vyos_defined %}
 key-pin = {{ ssl.passphrase }}
-{% endif %}
+{%     endif %}
 {% endif %}
 
 {% if ssl.ca_certificate is vyos_defined %}
@@ -59,33 +59,33 @@ device = sslvpn
 # An alternative way of specifying the network:
 {% if network_settings %}
 # DNS settings
-{%   if network_settings.name_server is string %}
+{%     if network_settings.name_server is string %}
 dns = {{ network_settings.name_server }}
-{%   else %}
-{%     for dns in network_settings.name_server %}
+{%     else %}
+{%         for dns in network_settings.name_server %}
 dns = {{ dns }}
-{%     endfor %}
-{%   endif %}
+{%         endfor %}
+{%     endif %}
 # IPv4 network pool
-{%   if network_settings.client_ip_settings %}
-{%     if network_settings.client_ip_settings.subnet %}
+{%     if network_settings.client_ip_settings %}
+{%         if network_settings.client_ip_settings.subnet %}
 ipv4-network = {{ network_settings.client_ip_settings.subnet }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 # IPv6 network pool
-{%   if network_settings.client_ipv6_pool %}
-{%     if network_settings.client_ipv6_pool.prefix %}
+{%     if network_settings.client_ipv6_pool %}
+{%         if network_settings.client_ipv6_pool.prefix %}
 ipv6-network = {{ network_settings.client_ipv6_pool.prefix }}
 ipv6-subnet-prefix = {{ network_settings.client_ipv6_pool.mask }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 {% endif %}
 
 {% if network_settings.push_route is string %}
 route = {{ network_settings.push_route }}
 {% else %}
-{%   for route in network_settings.push_route %}
+{%     for route in network_settings.push_route %}
 route = {{ route }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
diff --git a/data/templates/ocserv/ocserv_otp_usr.tmpl b/data/templates/ocserv/ocserv_otp_usr.j2
index 18de5fec6..b2511ed94 100644
--- a/data/templates/ocserv/ocserv_otp_usr.tmpl
+++ b/data/templates/ocserv/ocserv_otp_usr.j2
@@ -1,8 +1,8 @@
 #<token_type> <username> <pin> <secret_hex_key> <counter> <lastpass> <time>
 {% if username is vyos_defined %}
-{%   for user, user_config in username.items() %}
-{%     if user_config.disable is not vyos_defined and user_config.otp is vyos_defined %}
+{%     for user, user_config in username.items() %}
+{%         if user_config.disable is not vyos_defined and user_config.otp is vyos_defined %}
 {{ user_config.otp.token_tmpl }} {{ user }} {{ user_config.otp.pin | default("-", true) }} {{ user_config.otp.key }}
-{%     endif %}
-{%   endfor %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/ocserv/ocserv_passwd.tmpl b/data/templates/ocserv/ocserv_passwd.j2
index 30c79d66a..30c79d66a 100644
--- a/data/templates/ocserv/ocserv_passwd.tmpl
+++ b/data/templates/ocserv/ocserv_passwd.j2
diff --git a/data/templates/ocserv/radius_conf.tmpl b/data/templates/ocserv/radius_conf.j2
index 1712d83ef..b6612fee5 100644
--- a/data/templates/ocserv/radius_conf.tmpl
+++ b/data/templates/ocserv/radius_conf.j2
@@ -1,13 +1,13 @@
 ### generated by vpn_openconnect.py ###
 nas-identifier VyOS
 {% for srv in server %}
-{%   if not "disable" in server[srv] %}
-{%     if "port" in server[srv] %}
-authserver {{ srv }}:{{server[srv]["port"]}}
-{%     else %}
+{%     if not "disable" in server[srv] %}
+{%         if "port" in server[srv] %}
+authserver {{ srv }}:{{ server[srv]["port"] }}
+{%         else %}
 authserver {{ srv }}
+{%         endif %}
 {%     endif %}
-{%   endif %}
 {% endfor %}
 radius_timeout {{ timeout }}
 {% if source_address %}
@@ -15,7 +15,7 @@ bindaddr {{ source_address }}
 {% else %}
 bindaddr *
 {% endif %}
-servers /run/ocserv/radius_servers  
+servers /run/ocserv/radius_servers
 dictionary /etc/radcli/dictionary
 default_realm
 radius_retries 3
diff --git a/data/templates/ocserv/radius_servers.j2 b/data/templates/ocserv/radius_servers.j2
new file mode 100644
index 000000000..302e91600
--- /dev/null
+++ b/data/templates/ocserv/radius_servers.j2
@@ -0,0 +1,7 @@
+### generated by vpn_openconnect.py ###
+# server   key
+{% for srv in server %}
+{%     if not "disable" in server[srv] %}
+{{ srv }}   {{ server[srv].key }}
+{%     endif %}
+{% endfor %}
diff --git a/data/templates/ocserv/radius_servers.tmpl b/data/templates/ocserv/radius_servers.tmpl
deleted file mode 100644
index 7bacac992..000000000
--- a/data/templates/ocserv/radius_servers.tmpl
+++ /dev/null
@@ -1,7 +0,0 @@
-### generated by vpn_openconnect.py ###
-# server	key
-{% for srv in server %}
-{%   if not "disable" in server[srv] %}
-{{ srv }}	{{ server[srv].key }}
-{%   endif %}
-{% endfor %}
diff --git a/data/templates/pmacct/override.conf.tmpl b/data/templates/pmacct/override.conf.j2
index 213569ddc..213569ddc 100644
--- a/data/templates/pmacct/override.conf.tmpl
+++ b/data/templates/pmacct/override.conf.j2
diff --git a/data/templates/pmacct/uacctd.conf.tmpl b/data/templates/pmacct/uacctd.conf.j2
index 7e4f80e95..ea6247005 100644
--- a/data/templates/pmacct/uacctd.conf.tmpl
+++ b/data/templates/pmacct/uacctd.conf.j2
@@ -20,14 +20,14 @@ imt_mem_pools_number: 169
 
 {% set plugin = [] %}
 {% if netflow.server is vyos_defined %}
-{%   for server in netflow.server %}
-{%     set _ = plugin.append('nfprobe[nf_' ~ server ~ ']') %}
-{%   endfor %}
+{%     for server in netflow.server %}
+{%         set _ = plugin.append('nfprobe[nf_' ~ server ~ ']') %}
+{%     endfor %}
 {% endif %}
 {% if sflow.server is vyos_defined %}
-{%   for server in sflow.server %}
-{%     set _ = plugin.append('sfprobe[sf_' ~ server ~ ']') %}
-{%   endfor %}
+{%     for server in sflow.server %}
+{%         set _ = plugin.append('sfprobe[sf_' ~ server ~ ']') %}
+{%     endfor %}
 {% endif %}
 {% if disable_imt is not defined %}
 {%     set _ = plugin.append('memory') %}
@@ -36,39 +36,39 @@ plugins: {{ plugin | join(',') }}
 
 {% if netflow.server is vyos_defined %}
 # NetFlow servers
-{%   for server, server_config in netflow.server.items() %}
+{%     for server, server_config in netflow.server.items() %}
 nfprobe_receiver[nf_{{ server }}]: {{ server }}:{{ server_config.port }}
 nfprobe_version[nf_{{ server }}]: {{ netflow.version }}
-{%     if netflow.engine_id is vyos_defined %}
+{%         if netflow.engine_id is vyos_defined %}
 nfprobe_engine[nf_{{ server }}]: {{ netflow.engine_id }}
-{%     endif %}
-{%     if netflow.max_flows is vyos_defined %}
+{%         endif %}
+{%         if netflow.max_flows is vyos_defined %}
 nfprobe_maxflows[nf_{{ server }}]: {{ netflow.max_flows }}
-{%     endif %}
-{%     if netflow.sampling_rate is vyos_defined %}
+{%         endif %}
+{%         if netflow.sampling_rate is vyos_defined %}
 sampling_rate[nf_{{ server }}]: {{ netflow.sampling_rate }}
-{%     endif %}
-{%     if netflow.source_address is vyos_defined %}
+{%         endif %}
+{%         if netflow.source_address is vyos_defined %}
 nfprobe_source_ip[nf_{{ server }}]: {{ netflow.source_address }}
-{%     endif %}
-{%     if netflow.timeout is vyos_defined %}
+{%         endif %}
+{%         if netflow.timeout is vyos_defined %}
 nfprobe_timeouts[nf_{{ server }}]: expint={{ netflow.timeout.expiry_interval }}:general={{ netflow.timeout.flow_generic }}:icmp={{ netflow.timeout.icmp }}:maxlife={{ netflow.timeout.max_active_life }}:tcp.fin={{ netflow.timeout.tcp_fin }}:tcp={{ netflow.timeout.tcp_generic }}:tcp.rst={{ netflow.timeout.tcp_rst }}:udp={{ netflow.timeout.udp }}
-{%     endif %}
+{%         endif %}
 
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if sflow.server is vyos_defined %}
 # sFlow servers
-{%   for server, server_config in sflow.server.items() %}
+{%     for server, server_config in sflow.server.items() %}
 sfprobe_receiver[sf_{{ server }}]: {{ server }}:{{ server_config.port }}
 sfprobe_agentip[sf_{{ server }}]: {{ sflow.agent_address }}
-{%     if sflow.sampling_rate is vyos_defined %}
+{%         if sflow.sampling_rate is vyos_defined %}
 sampling_rate[sf_{{ server }}]: {{ sflow.sampling_rate }}
-{%     endif %}
-{%     if sflow.source_address is vyos_defined %}
+{%         endif %}
+{%         if sflow.source_address is vyos_defined %}
 sfprobe_source_ip[sf_{{ server }}]: {{ sflow.source_address }}
-{%     endif %}
+{%         endif %}
 
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/pppoe/ip-down.script.tmpl b/data/templates/pppoe/ip-down.script.tmpl
deleted file mode 100644
index 0be7b03c8..000000000
--- a/data/templates/pppoe/ip-down.script.tmpl
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/sh
-
-# As PPPoE is an "on demand" interface we need to re-configure it when it
-# becomes up
-if [ "$6" != "{{ ifname }}" ]; then
-    exit
-fi
-
-# add some info to syslog
-DIALER_PID=$(cat /var/run/{{ ifname }}.pid)
-logger -t pppd[$DIALER_PID] "executing $0"
-
-{% if connect_on_demand is not defined %}
-# See https://phabricator.vyos.net/T2248. Determine if we are enslaved to a
-# VRF, this is needed to properly insert the default route.
-VRF_NAME=""
-if [ -d /sys/class/net/{{ ifname }}/upper_* ]; then
-    # Determine upper (VRF) interface
-    VRF=$(basename $(ls -d /sys/class/net/{{ ifname }}/upper_*))
-    # Remove upper_ prefix from result string
-    VRF=${VRF#"upper_"}
-    # Populate variable to run in VR context
-    VRF_NAME="vrf ${VRF_NAME}"
-fi
-
-{%   if default_route != 'none' %}
-# Always delete default route when interface goes down if we installed it
-vtysh -c "conf t" ${VRF_NAME} -c "no ip route 0.0.0.0/0 {{ ifname }} ${VRF_NAME}"
-{%      if ipv6.address.autoconf is vyos_defined %}
-vtysh -c "conf t" ${VRF_NAME} -c "no ipv6 route ::/0 {{ ifname }} ${VRF_NAME}"
-{%      endif %}
-{%   endif %}
-{% endif %}
-
-{% if dhcpv6_options.pd is vyos_defined %}
-# Stop wide dhcpv6 client
-systemctl stop dhcp6c@{{ ifname }}.service
-{% endif %}
diff --git a/data/templates/pppoe/ip-pre-up.script.tmpl b/data/templates/pppoe/ip-pre-up.script.tmpl
deleted file mode 100644
index a54e4e9bd..000000000
--- a/data/templates/pppoe/ip-pre-up.script.tmpl
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/sh
-
-# As PPPoE is an "on demand" interface we need to re-configure it when it
-# becomes up
-if [ "$6" != "{{ ifname }}" ]; then
-    exit
-fi
-
-# add some info to syslog
-DIALER_PID=$(cat /var/run/{{ ifname }}.pid)
-logger -t pppd[$DIALER_PID] "executing $0"
-
-echo "{{ description }}" > /sys/class/net/{{ ifname }}/ifalias
-
-{% if vrf %}
-logger -t pppd[$DIALER_PID] "configuring dialer interface $6 for VRF {{ vrf }}"
-ip link set dev {{ ifname }} master {{ vrf }}
-{% endif %}
diff --git a/data/templates/pppoe/ip-up.script.tmpl b/data/templates/pppoe/ip-up.script.tmpl
deleted file mode 100644
index 302756960..000000000
--- a/data/templates/pppoe/ip-up.script.tmpl
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/bin/sh
-
-# As PPPoE is an "on demand" interface we need to re-configure it when it
-# becomes up
-if [ "$6" != "{{ ifname }}" ]; then
-    exit
-fi
-
-{% if connect_on_demand is not defined %}
-# add some info to syslog
-DIALER_PID=$(cat /var/run/{{ ifname }}.pid)
-logger -t pppd[$DIALER_PID] "executing $0"
-
-{%   if default_route != 'none' %}
-# See https://phabricator.vyos.net/T2248 & T2220. Determine if we are enslaved
-# to a VRF, this is needed to properly insert the default route.
-
-SED_OPT="^ip route"
-VRF_NAME=""
-if [ -d /sys/class/net/{{ ifname }}/upper_* ]; then
-    # Determine upper (VRF) interface
-    VRF=$(basename $(ls -d /sys/class/net/{{ ifname }}/upper_*))
-    # Remove upper_ prefix from result string
-    VRF=${VRF#"upper_"}
-    # generate new SED command
-    SED_OPT="vrf ${VRF}"
-    # generate vtysh option
-    VRF_NAME="vrf ${VRF}"
-fi
-
-{%     if default_route == 'auto' %}
-# Only insert a new default route if there is no default route configured
-routes=$(vtysh -c "show running-config" | sed -n "/${SED_OPT}/,/!/p" | grep 0.0.0.0/0 | wc -l)
-if [ "$routes" -ne 0 ]; then
-    exit 1
-fi
-
-{%     elif default_route == 'force' %}
-# Retrieve current static default routes and remove it from the routing table
-vtysh -c "show running-config" | sed -n "/${SED_OPT}/,/!/p" | grep 0.0.0.0/0 | while read route ; do
-    vtysh -c "conf t" ${VTY_OPT} -c "no ${route} ${VRF_NAME}"
-done
-{%     endif %}
-
-# Add default route to default or VRF routing table
-vtysh -c "conf t" ${VTY_OPT} -c "ip route 0.0.0.0/0 {{ ifname }} ${VRF_NAME}"
-logger -t pppd[$DIALER_PID] "added default route via {{ ifname }} ${VRF_NAME}"
-{%   endif %}
-{% endif %}
diff --git a/data/templates/pppoe/ipv6-up.script.tmpl b/data/templates/pppoe/ipv6-up.script.tmpl
deleted file mode 100644
index da73cb4d5..000000000
--- a/data/templates/pppoe/ipv6-up.script.tmpl
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/bin/sh
-
-# As PPPoE is an "on demand" interface we need to re-configure it when it
-# becomes up
-
-if [ "$6" != "{{ ifname }}" ]; then
-    exit
-fi
-
-
-{% if default_route != 'none' %}
-# See https://phabricator.vyos.net/T2248 & T2220. Determine if we are enslaved
-# to a VRF, this is needed to properly insert the default route.
-
-SED_OPT="^ipv6 route"
-VRF_NAME=""
-if [ -d /sys/class/net/{{ ifname }}/upper_* ]; then
-    # Determine upper (VRF) interface
-    VRF=$(basename $(ls -d /sys/class/net/{{ ifname }}/upper_*))
-    # Remove upper_ prefix from result string
-    VRF=${VRF#"upper_"}
-    # generate new SED command
-    SED_OPT="vrf ${VRF}"
-    # generate vtysh option
-    VRF_NAME="vrf ${VRF}"
-fi
-
-{%   if default_route == 'auto' %}
-# Only insert a new default route if there is no default route configured
-routes=$(vtysh -c "show running-config" | sed -n "/${SED_OPT}/,/!/p" | grep ::/0 | wc -l)
-if [ "$routes" -ne 0 ]; then
-    exit 1
-fi
-
-{%   elif default_route == 'force' %}
-# Retrieve current static default routes and remove it from the routing table
-vtysh -c "show running-config" | sed -n "/${SED_OPT}/,/!/p" | grep ::/0 | while read route ; do
-    vtysh -c "conf t" ${VTY_OPT} -c "no ${route} ${VRF_NAME}"
-done
-{%   endif %}
-
-# Add default route to default or VRF routing table
-vtysh -c "conf t" ${VTY_OPT} -c "ipv6 route ::/0 {{ ifname }} ${VRF_NAME}"
-logger -t pppd[$DIALER_PID] "added default route via {{ ifname }} ${VRF_NAME}"
-{% endif %}
-
diff --git a/data/templates/pppoe/peer.tmpl b/data/templates/pppoe/peer.j2
index d6d63debf..6221abb9b 100644
--- a/data/templates/pppoe/peer.tmpl
+++ b/data/templates/pppoe/peer.j2
@@ -67,14 +67,14 @@ demand
 # See T2249. PPP default route options should only be set when in on-demand
 # mode. As soon as we are not in on-demand mode the default-route handling is
 # passed to the ip-up.d/ip-down.s scripts which is required for VRF support.
-{%   if 'auto' in default_route %}
+{%     if 'auto' in default_route %}
 defaultroute
 {{ 'defaultroute6' if ipv6 is vyos_defined }}
-{%   elif 'force' in default_route %}
+{%     elif 'force' in default_route %}
 defaultroute
 replacedefaultroute
 {{ 'defaultroute6' if ipv6 is vyos_defined }}
-{%   endif %}
+{%     endif %}
 {% else %}
 nodefaultroute
 noreplacedefaultroute
diff --git a/data/templates/router-advert/radvd.conf.tmpl b/data/templates/router-advert/radvd.conf.j2
index b40ba1ee0..6902dc05a 100644
--- a/data/templates/router-advert/radvd.conf.tmpl
+++ b/data/templates/router-advert/radvd.conf.j2
@@ -1,66 +1,66 @@
 ### Autogenerated by service_router-advert.py ###
 
 {% if interface is vyos_defined %}
-{%   for iface, iface_config in interface.items() %}
+{%     for iface, iface_config in interface.items() %}
 interface {{ iface }} {
     IgnoreIfMissing on;
-{%     if iface_config.default_preference is vyos_defined %}
+{%         if iface_config.default_preference is vyos_defined %}
     AdvDefaultPreference {{ iface_config.default_preference }};
-{%     endif %}
-{%     if iface_config.managed_flag is vyos_defined %}
+{%         endif %}
+{%         if iface_config.managed_flag is vyos_defined %}
     AdvManagedFlag {{ 'on' if iface_config.managed_flag is vyos_defined else 'off' }};
-{%     endif %}
-{%     if iface_config.interval.max is vyos_defined %}
+{%         endif %}
+{%         if iface_config.interval.max is vyos_defined %}
     MaxRtrAdvInterval {{ iface_config.interval.max }};
-{%     endif %}
-{%     if iface_config.interval.min is vyos_defined %}
+{%         endif %}
+{%         if iface_config.interval.min is vyos_defined %}
     MinRtrAdvInterval {{ iface_config.interval.min }};
-{%   endif %}
-{%     if iface_config.reachable_time is vyos_defined %}
+{%         endif %}
+{%         if iface_config.reachable_time is vyos_defined %}
     AdvReachableTime {{ iface_config.reachable_time }};
-{%   endif %}
+{%         endif %}
     AdvIntervalOpt {{ 'off' if iface_config.no_send_advert is vyos_defined else 'on' }};
     AdvSendAdvert {{ 'off' if iface_config.no_send_advert is vyos_defined else 'on' }};
-{%     if iface_config.default_lifetime is vyos_defined %}
+{%         if iface_config.default_lifetime is vyos_defined %}
     AdvDefaultLifetime {{ iface_config.default_lifetime }};
-{%     endif %}
-{%     if iface_config.link_mtu is vyos_defined %}
+{%         endif %}
+{%         if iface_config.link_mtu is vyos_defined %}
     AdvLinkMTU {{ iface_config.link_mtu }};
-{%     endif %}
+{%         endif %}
     AdvOtherConfigFlag {{ 'on' if iface_config.other_config_flag is vyos_defined else 'off' }};
     AdvRetransTimer {{ iface_config.retrans_timer }};
     AdvCurHopLimit {{ iface_config.hop_limit }};
-{%     if iface_config.route is vyos_defined %}
-{%       for route, route_options in iface_config.route.items() %}
+{%         if iface_config.route is vyos_defined %}
+{%             for route, route_options in iface_config.route.items() %}
     route {{ route }} {
-{%         if route_options.valid_lifetime is vyos_defined %}
+{%                 if route_options.valid_lifetime is vyos_defined %}
         AdvRouteLifetime {{ route_options.valid_lifetime }};
-{%         endif %}
-{%         if route_options.route_preference is vyos_defined %}
+{%                 endif %}
+{%                 if route_options.route_preference is vyos_defined %}
         AdvRoutePreference {{ route_options.route_preference }};
-{%         endif %}
+{%                 endif %}
         RemoveRoute {{ 'off' if route_options.no_remove_route is vyos_defined else 'on' }};
     };
-{%       endfor %}
-{%     endif %}
-{%     if iface_config.prefix is vyos_defined %}
-{%       for prefix, prefix_options in iface_config.prefix.items() %}
+{%             endfor %}
+{%         endif %}
+{%         if iface_config.prefix is vyos_defined %}
+{%             for prefix, prefix_options in iface_config.prefix.items() %}
     prefix {{ prefix }} {
         AdvAutonomous {{ 'off' if prefix_options.no_autonomous_flag is vyos_defined else 'on' }};
         AdvValidLifetime {{ prefix_options.valid_lifetime }};
         AdvOnLink {{ 'off' if prefix_options.no_on_link_flag is vyos_defined else 'on' }};
         AdvPreferredLifetime {{ prefix_options.preferred_lifetime }};
     };
-{%       endfor %}
-{%     endif %}
-{%     if iface_config.name_server is vyos_defined %}
+{%             endfor %}
+{%         endif %}
+{%         if iface_config.name_server is vyos_defined %}
     RDNSS {{ iface_config.name_server | join(" ") }} {
     };
-{%     endif %}
-{%     if iface_config.dnssl is vyos_defined %}
+{%         endif %}
+{%         if iface_config.dnssl is vyos_defined %}
     DNSSL {{ iface_config.dnssl | join(" ") }} {
     };
-{%     endif %}
+{%         endif %}
 };
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/snmp/etc.snmp.conf.tmpl b/data/templates/snmp/etc.snmp.conf.j2
index 8012cf6bb..8012cf6bb 100644
--- a/data/templates/snmp/etc.snmp.conf.tmpl
+++ b/data/templates/snmp/etc.snmp.conf.j2
diff --git a/data/templates/snmp/etc.snmpd.conf.j2 b/data/templates/snmp/etc.snmpd.conf.j2
new file mode 100644
index 000000000..d7dc0ba5d
--- /dev/null
+++ b/data/templates/snmp/etc.snmpd.conf.j2
@@ -0,0 +1,182 @@
+### Autogenerated by snmp.py ###
+
+# non configurable defaults
+sysObjectID 1.3.6.1.4.1.44641
+sysServices 14
+master agentx
+agentXPerms 0777 0777
+pass .1.3.6.1.2.1.31.1.1.1.18 /opt/vyatta/sbin/if-mib-alias
+smuxpeer .1.3.6.1.2.1.83
+smuxpeer .1.3.6.1.2.1.157
+smuxsocket localhost
+
+# linkUp/Down configure the Event MIB tables to monitor
+# the ifTable for network interfaces being taken up or down
+# for making internal queries to retrieve any necessary information
+iquerySecName {{ vyos_user }}
+
+# Modified from the default linkUpDownNotification
+# to include more OIDs and poll more frequently
+notificationEvent  linkUpTrap    linkUp   ifIndex ifDescr ifType ifAdminStatus ifOperStatus
+notificationEvent  linkDownTrap  linkDown ifIndex ifDescr ifType ifAdminStatus ifOperStatus
+monitor  -r 10 -e linkUpTrap   "Generate linkUp" ifOperStatus != 2
+monitor  -r 10 -e linkDownTrap "Generate linkDown" ifOperStatus == 2
+
+# Remove all old ifTable entries with the same ifName as newly appeared
+# interface (with different ifIndex) - this is the case on e.g. ppp interfaces
+interface_replace_old yes
+
+########################
+# configurable section #
+########################
+
+# Default system description is VyOS version
+sysDescr VyOS {{ version }}
+
+{% if description is vyos_defined %}
+# Description
+SysDescr {{ description }}
+{% endif %}
+
+# Listen
+{% set options = [] %}
+{% if listen_address is vyos_defined %}
+{%     for address, address_options in listen_address.items() %}
+{%         if address | is_ipv6 %}
+{%             set protocol = protocol ~ '6' %}
+{%         endif %}
+{%         set _ = options.append(protocol ~ ':' ~ address | bracketize_ipv6 ~ ':' ~ address_options.port) %}
+{%     endfor %}
+{% else %}
+{%     set _ = options.append(protocol ~ ':161') %}
+{%     set _ = options.append(protocol ~ '6:161') %}
+{% endif %}
+agentaddress unix:/run/snmpd.socket{{ ',' ~ options | join(',') if options is vyos_defined }}
+
+# SNMP communities
+{% if community is vyos_defined %}
+{%     for comm, comm_config in community.items() %}
+{%         if comm_config.client is vyos_defined %}
+{%             for client in comm_config.client %}
+{%                 if client | is_ipv4 %}
+{{ comm_config.authorization }}community {{ comm }} {{ client }}
+{%                 elif client | is_ipv6 %}
+{{ comm_config.authorization }}community6 {{ comm }} {{ client }}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if comm_config.network is vyos_defined %}
+{%             for network in comm_config.network %}
+{%                 if network | is_ipv4 %}
+{{ comm_config.authorization }}community {{ comm }} {{ network }}
+{%                 elif client | is_ipv6 %}
+{{ comm_config.authorization }}community6 {{ comm }} {{ network }}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if comm_config.client is not vyos_defined and comm_config.network is not vyos_defined %}
+{{ comm_config.authorization }}community {{ comm }}
+{%         endif %}
+{%     endfor %}
+{% endif %}
+
+{% if contact is vyos_defined %}
+# system contact information
+SysContact {{ contact }}
+{% endif %}
+
+{% if location is vyos_defined %}
+# system location information
+SysLocation {{ location }}
+{% endif %}
+
+{% if smux_peer is vyos_defined %}
+# additional smux peers
+{%     for peer in smux_peer %}
+smuxpeer {{ peer }}
+{%     endfor %}
+{% endif %}
+
+{% if trap_target is vyos_defined %}
+# if there is a problem - tell someone!
+{%     for trap, trap_config in trap_target.items() %}
+trap2sink {{ trap }}:{{ trap_config.port }} {{ trap_config.community }}
+{%     endfor %}
+{% endif %}
+
+{% if v3 is vyos_defined %}
+#
+# SNMPv3 stuff goes here
+#
+{%     if v3.view is vyos_defined %}
+# views
+{%         for view, view_config in v3.view.items() %}
+{%             if view_config.oid is vyos_defined %}
+{%                 for oid in view_config.oid %}
+view {{ view }} included .{{ oid }}
+{%                 endfor %}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+
+# access
+{%     if v3.group is vyos_defined %}
+#             context sec.model sec.level match  read    write  notif
+{%         for group, group_config in v3.group.items() %}
+access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view }} {{ 'none' if group_config.mode == 'ro' else group_config.view }} none
+{%         endfor %}
+{%     endif %}
+
+# trap-target
+{%     if v3.trap_target is vyos_defined %}
+{%         for trap, trap_config in v3.trap_target.items() %}
+{%             set options = '' %}
+{%             if trap_config.type == 'inform' %}
+{%                 set options = options ~ ' -Ci' %}
+{%             endif %}
+{%             if v3.engineid is vyos_defined %}
+{%                 set options = options ~ ' -e "' ~ v3.engineid ~ '"' %}
+{%             endif %}
+{%             if trap_config.user is vyos_defined %}
+{%                 set options = options ~ ' -u ' ~ trap_config.user %}
+{%             endif %}
+{%             if trap_config.auth.plaintext_password is vyos_defined or trap_config.auth.encrypted_password is vyos_defined %}
+{%                 set options = options ~ ' -a ' ~ trap_config.auth.type %}
+{%                 if trap_config.auth.plaintext_password is vyos_defined %}
+{%                     set options = options ~ ' -A ' ~ trap_config.auth.plaintext_password %}
+{%                 elif trap_config.auth.encrypted_password is vyos_defined %}
+{%                     set options = options ~ ' -3m ' ~ trap_config.auth.encrypted_password %}
+{%                 endif %}
+{%                 if trap_config.privacy.plaintext_password is vyos_defined or trap_config.privacy.encrypted_password is vyos_defined %}
+{%                     set options = options ~ ' -x ' ~ trap_config.privacy.type %}
+{%                     if trap_config.privacy.plaintext_password is vyos_defined %}
+{%                         set options = options ~ ' -X ' ~ trap_config.privacy.plaintext_password %}
+{%                     elif trap_config.privacy.encrypted_password is vyos_defined %}
+{%                         set options = options ~ ' -3M ' ~ trap_config.privacy.encrypted_password %}
+{%                     endif %}
+{%                     set options = options ~ ' -l authPriv' %}
+{%                 else %}
+{%                     set options = options ~ ' -l authNoPriv' %}
+{%                 endif %}
+{%             else %}
+{%                 set options = options ~ ' -l noAuthNoPriv' %}
+{%             endif %}
+trapsess -v 3 {{ options }} {{ trap }}:{{ trap_config.protocol }}:{{ trap_config.port }}
+{%         endfor %}
+{%     endif %}
+
+# group
+{%     if v3.user is vyos_defined %}
+{%         for user, user_config in v3.user.items() %}
+group {{ user_config.group }} usm {{ user }}
+{%         endfor %}
+{%     endif %}
+{# SNMPv3 end #}
+{% endif %}
+
+{% if script_extensions.extension_name is vyos_defined %}
+# extension scripts
+{%     for script, script_config in script_extensions.extension_name.items() | sort(attribute=script) %}
+extend {{ script }} {{ script_config.script }}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/snmp/etc.snmpd.conf.tmpl b/data/templates/snmp/etc.snmpd.conf.tmpl
deleted file mode 100644
index 510b35097..000000000
--- a/data/templates/snmp/etc.snmpd.conf.tmpl
+++ /dev/null
@@ -1,182 +0,0 @@
-### Autogenerated by snmp.py ###
-
-# non configurable defaults
-sysObjectID 1.3.6.1.4.1.44641
-sysServices 14
-master agentx
-agentXPerms 0777 0777
-pass .1.3.6.1.2.1.31.1.1.1.18 /opt/vyatta/sbin/if-mib-alias
-smuxpeer .1.3.6.1.2.1.83
-smuxpeer .1.3.6.1.2.1.157
-smuxsocket localhost
-
-# linkUp/Down configure the Event MIB tables to monitor
-# the ifTable for network interfaces being taken up or down
-# for making internal queries to retrieve any necessary information
-iquerySecName {{ vyos_user }}
-
-# Modified from the default linkUpDownNotification
-# to include more OIDs and poll more frequently
-notificationEvent  linkUpTrap    linkUp   ifIndex ifDescr ifType ifAdminStatus ifOperStatus
-notificationEvent  linkDownTrap  linkDown ifIndex ifDescr ifType ifAdminStatus ifOperStatus
-monitor  -r 10 -e linkUpTrap   "Generate linkUp" ifOperStatus != 2
-monitor  -r 10 -e linkDownTrap "Generate linkDown" ifOperStatus == 2
-
-# Remove all old ifTable entries with the same ifName as newly appeared
-# interface (with different ifIndex) - this is the case on e.g. ppp interfaces
-interface_replace_old yes
-
-########################
-# configurable section #
-########################
-
-# Default system description is VyOS version
-sysDescr VyOS {{ version }}
-
-{% if description is vyos_defined %}
-# Description
-SysDescr {{ description }}
-{% endif %}
-
-# Listen
-{% set options = [] %}
-{% if listen_address is vyos_defined %}
-{%   for address, address_options in listen_address.items() %}
-{%     if address | is_ipv6 %}
-{%       set protocol = protocol ~ '6' %}
-{%     endif %}
-{%     set _ = options.append(protocol ~ ':' ~ address | bracketize_ipv6 ~ ':' ~ address_options.port) %}
-{%   endfor %}
-{% else %}
-{%   set _ = options.append(protocol ~ ':161') %}
-{%   set _ = options.append(protocol ~ '6:161') %}
-{% endif %}
-agentaddress unix:/run/snmpd.socket{{ ',' ~ options | join(',') if options is vyos_defined }}
-
-# SNMP communities
-{% if community is vyos_defined %}
-{%   for comm, comm_config in community.items() %}
-{%     if comm_config.client is vyos_defined %}
-{%       for client in comm_config.client %}
-{%         if client | is_ipv4 %}
-{{ comm_config.authorization }}community {{ comm }} {{ client }}
-{%         elif client | is_ipv6 %}
-{{ comm_config.authorization }}community6 {{ comm }} {{ client }}
-{%         endif %}
-{%       endfor %}
-{%     endif %}
-{%     if comm_config.network is vyos_defined %}
-{%       for network in comm_config.network %}
-{%         if network | is_ipv4 %}
-{{ comm_config.authorization }}community {{ comm }} {{ network }}
-{%         elif client | is_ipv6 %}
-{{ comm_config.authorization }}community6 {{ comm }} {{ network }}
-{%         endif %}
-{%       endfor %}
-{%     endif %}
-{%     if comm_config.client is not vyos_defined and comm_config.network is not vyos_defined %}
-{{ comm_config.authorization }}community {{ comm }}
-{%     endif %}
-{%   endfor %}
-{% endif %}
-
-{% if contact is vyos_defined %}
-# system contact information
-SysContact {{ contact }}
-{% endif %}
-
-{% if location is vyos_defined %}
-# system location information
-SysLocation {{ location }}
-{% endif %}
-
-{% if smux_peer is vyos_defined %}
-# additional smux peers
-{%   for peer in smux_peer %}
-smuxpeer {{ peer }}
-{%   endfor %}
-{% endif %}
-
-{% if trap_target is vyos_defined %}
-# if there is a problem - tell someone!
-{%   for trap, trap_config in trap_target.items() %}
-trap2sink {{ trap }}:{{ trap_config.port }} {{ trap_config.community }}
-{%   endfor %}
-{% endif %}
-
-{% if v3 is vyos_defined %}
-#
-# SNMPv3 stuff goes here
-#
-{%   if v3.view is vyos_defined %}
-# views
-{%     for view, view_config in v3.view.items() %}
-{%       if view_config.oid is vyos_defined %}
-{%         for oid in view_config.oid %}
-view {{ view }} included .{{ oid }}
-{%         endfor %}
-{%       endif %}
-{%     endfor %}
-{%   endif %}
-
-# access
-{%   if v3.group is vyos_defined %}
-#             context sec.model sec.level match  read    write  notif
-{%     for group, group_config in v3.group.items() %}
-access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view }} {% if group_config.mode == 'ro' %}none{% else %}{{ group_config.view }}{% endif %} none
-{%     endfor %}
-{%   endif %}
-
-# trap-target
-{%   if v3.trap_target is vyos_defined %}
-{%     for trap, trap_config in v3.trap_target.items() %}
-{%       set options = '' %}
-{%       if trap_config.type == 'inform' %}
-{%         set options = options ~ ' -Ci' %}
-{%       endif %}
-{%       if v3.engineid is vyos_defined %}
-{%         set options = options ~ ' -e "' ~ v3.engineid ~ '"' %}
-{%       endif %}
-{%       if trap_config.user is vyos_defined %}
-{%         set options = options ~ ' -u ' ~ trap_config.user %}
-{%       endif %}
-{%       if trap_config.auth.plaintext_password is vyos_defined or trap_config.auth.encrypted_password is vyos_defined %}
-{%         set options = options ~ ' -a ' ~ trap_config.auth.type %}
-{%         if trap_config.auth.plaintext_password is vyos_defined %}
-{%           set options = options ~ ' -A ' ~ trap_config.auth.plaintext_password %}
-{%         elif trap_config.auth.encrypted_password is vyos_defined %}
-{%           set options = options ~ ' -3m ' ~ trap_config.auth.encrypted_password %}
-{%         endif %}
-{%         if trap_config.privacy.plaintext_password is vyos_defined or trap_config.privacy.encrypted_password is vyos_defined %}
-{%           set options = options ~ ' -x ' ~ trap_config.privacy.type %}
-{%           if trap_config.privacy.plaintext_password is vyos_defined %}
-{%             set options = options ~ ' -X ' ~ trap_config.privacy.plaintext_password %}
-{%           elif trap_config.privacy.encrypted_password is vyos_defined %}
-{%             set options = options ~ ' -3M ' ~ trap_config.privacy.encrypted_password %}
-{%           endif %}
-{%           set options = options ~ ' -l authPriv' %}
-{%         else %}
-{%           set options = options ~ ' -l authNoPriv' %}
-{%         endif %}
-{%       else %}
-{%         set options = options ~ ' -l noAuthNoPriv' %}
-{%       endif %}
-trapsess -v 3 {{ options }} {{ trap }}:{{ trap_config.protocol }}:{{ trap_config.port }}
-{%     endfor %}
-{%   endif %}
-
-# group
-{%   if v3.user is vyos_defined %}
-{%     for user, user_config in v3.user.items() %}
-group {{ user_config.group }} usm {{ user }}
-{%     endfor %}
-{%   endif %}
-{# SNMPv3 end #}
-{% endif %}
-
-{% if script_extensions.extension_name is vyos_defined %}
-# extension scripts
-{%   for script, script_config in script_extensions.extension_name.items() | sort(attribute=script) %}
-extend {{ script }} {{ script_config.script }}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/snmp/override.conf.tmpl b/data/templates/snmp/override.conf.j2
index 5d787de86..5d787de86 100644
--- a/data/templates/snmp/override.conf.tmpl
+++ b/data/templates/snmp/override.conf.j2
diff --git a/data/templates/snmp/usr.snmpd.conf.tmpl b/data/templates/snmp/usr.snmpd.conf.j2
index a46b3997f..a713c1cec 100644
--- a/data/templates/snmp/usr.snmpd.conf.tmpl
+++ b/data/templates/snmp/usr.snmpd.conf.j2
@@ -1,8 +1,8 @@
 ### Autogenerated by snmp.py ###
-{%   if v3.user is vyos_defined %}
+{% if v3.user is vyos_defined %}
 {%     for user, user_config in v3.user.items() %}
 {{ user_config.mode }}user {{ user }}
 {%     endfor %}
-{%   endif %}
+{% endif %}
 
 rwuser {{ vyos_user }}
diff --git a/data/templates/snmp/var.snmpd.conf.tmpl b/data/templates/snmp/var.snmpd.conf.j2
index 16d39db89..012f33aeb 100644
--- a/data/templates/snmp/var.snmpd.conf.tmpl
+++ b/data/templates/snmp/var.snmpd.conf.j2
@@ -1,16 +1,16 @@
 ### Autogenerated by snmp.py ###
 # user
 {% if v3 is vyos_defined %}
-{%   if v3.user is vyos_defined %}
-{%     for user, user_config in v3.user.items() %}
+{%     if v3.user is vyos_defined %}
+{%         for user, user_config in v3.user.items() %}
 usmUser 1 3 0x{{ v3.engineid }} "{{ user }}" "{{ user }}" NULL {{ user_config.auth.type | snmp_auth_oid }} 0x{{ user_config.auth.encrypted_password }} {{ user_config.privacy.type | snmp_auth_oid }} 0x{{ user_config.privacy.encrypted_password }} 0x
-{%     endfor %}
-{%   endif %}
+{%         endfor %}
+{%     endif %}
 
 # VyOS default user
 createUser {{ vyos_user }} MD5 "{{ vyos_user_pass }}" DES
 
-{%   if v3.engineid is vyos_defined %}
+{%     if v3.engineid is vyos_defined %}
 oldEngineID 0x{{ v3.engineid }}
-{%   endif %}
+{%     endif %}
 {% endif %}
diff --git a/data/templates/squid/sg_acl.conf.tmpl b/data/templates/squid/sg_acl.conf.j2
index ce72b173a..ce72b173a 100644
--- a/data/templates/squid/sg_acl.conf.tmpl
+++ b/data/templates/squid/sg_acl.conf.j2
diff --git a/data/templates/squid/squid.conf.tmpl b/data/templates/squid/squid.conf.j2
index e8627b022..a0fdeb20e 100644
--- a/data/templates/squid/squid.conf.tmpl
+++ b/data/templates/squid/squid.conf.j2
@@ -16,23 +16,23 @@ acl Safe_ports port 777         # multiling http
 acl CONNECT method CONNECT
 
 {% if authentication is vyos_defined %}
-{%   if authentication.children is vyos_defined %}
+{%     if authentication.children is vyos_defined %}
 auth_param basic children {{ authentication.children }}
-{%   endif %}
-{%   if authentication.credentials_ttl is vyos_defined %}
+{%     endif %}
+{%     if authentication.credentials_ttl is vyos_defined %}
 auth_param basic credentialsttl {{ authentication.credentials_ttl }} minute
-{%   endif %}
-{%   if authentication.realm is vyos_defined %}
+{%     endif %}
+{%     if authentication.realm is vyos_defined %}
 auth_param basic realm "{{ authentication.realm }}"
-{%   endif %}
+{%     endif %}
 {# LDAP based Authentication #}
-{%   if authentication.method is vyos_defined %}
-{%     if authentication.ldap is vyos_defined and authentication.method is vyos_defined('ldap') %}
+{%     if authentication.method is vyos_defined %}
+{%         if authentication.ldap is vyos_defined and authentication.method is vyos_defined('ldap') %}
 auth_param basic program /usr/lib/squid/basic_ldap_auth -v {{ authentication.ldap.version }} -b "{{ authentication.ldap.base_dn }}" {{ '-D "' ~ authentication.ldap.bind_dn ~ '"' if authentication.ldap.bind_dn is vyos_defined }} {{ '-w "' ~ authentication.ldap.password ~ '"' if authentication.ldap.password is vyos_defined }} {{ '-f "' ~ authentication.ldap.filter_expression ~ '"' if authentication.ldap.filter_expression is vyos_defined }} {{ '-u "' ~ authentication.ldap.username_attribute ~ '"' if authentication.ldap.username_attribute is vyos_defined }} -p {{ authentication.ldap.port }} {{ '-ZZ' if authentication.ldap.use_ssl is vyos_defined }} -R -h "{{ authentication.ldap.server }}"
-{%     endif %}
+{%         endif %}
 acl auth proxy_auth REQUIRED
 http_access allow auth
-{%   endif %}
+{%     endif %}
 {% endif %}
 
 http_access allow manager localhost
@@ -44,18 +44,18 @@ http_access allow net
 http_access deny all
 
 {% if reply_block_mime is vyos_defined %}
-{%   for mime_type in reply_block_mime %}
+{%     for mime_type in reply_block_mime %}
 acl BLOCK_MIME rep_mime_type {{ mime_type }}
-{%   endfor %}
+{%     endfor %}
 http_reply_access deny BLOCK_MIME
 {% endif %}
 
 {% if cache_size is vyos_defined %}
-{%   if cache_size | int > 0 %}
+{%     if cache_size | int > 0 %}
 cache_dir ufs /var/spool/squid {{ cache_size }} 16 256
-{%   else %}
+{%     else %}
 # disabling disk cache
-{%   endif %}
+{%     endif %}
 {% endif %}
 {% if mem_cache_size is vyos_defined %}
 cache_mem {{ mem_cache_size }} MB
@@ -87,9 +87,9 @@ tcp_outgoing_address {{ outgoing_address }}
 
 
 {% if listen_address is vyos_defined %}
-{%   for address, config in listen_address.items() %}
+{%     for address, config in listen_address.items() %}
 http_port {{ address | bracketize_ipv6 }}:{{ config.port if config.port is vyos_defined else default_port }} {{ 'intercept' if config.disable_transparent is not vyos_defined }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 http_port 127.0.0.1:{{ default_port }}
 
@@ -104,8 +104,8 @@ url_rewrite_bypass on
 {% endif %}
 
 {% if cache_peer is vyos_defined %}
-{%   for peer, config in cache_peer.items() %}
+{%     for peer, config in cache_peer.items() %}
 cache_peer {{ config.address }} {{ config.type }} {{ config.http_port }} {{ config.icp_port }} {{ config.options }}
-{%   endfor %}
+{%     endfor %}
 never_direct allow all
 {% endif %}
diff --git a/data/templates/squid/squidGuard.conf.j2 b/data/templates/squid/squidGuard.conf.j2
new file mode 100644
index 000000000..1bc4c984f
--- /dev/null
+++ b/data/templates/squid/squidGuard.conf.j2
@@ -0,0 +1,124 @@
+### generated by service_webproxy.py ###
+
+{% macro sg_rule(category, log, db_dir) %}
+{% set expressions = db_dir + '/' + category + '/expressions' %}
+dest {{ category }}-default {
+        domainlist     {{ category }}/domains
+        urllist        {{ category }}/urls
+{% if expressions | is_file %}
+        expressionlist {{ category }}/expressions
+{% endif %}
+{% if log is vyos_defined %}
+        log            blacklist.log
+{% endif %}
+}
+{% endmacro %}
+
+{% if url_filtering is vyos_defined and url_filtering.disable is not vyos_defined %}
+{%     if url_filtering.squidguard is vyos_defined %}
+{%         set sg_config = url_filtering.squidguard %}
+{%         set acl = namespace(value='local-ok-default') %}
+{%         set acl.value = acl.value + ' !in-addr' if sg_config.allow_ipaddr_url is not defined else acl.value %}
+dbhome {{ squidguard_db_dir }}
+logdir /var/log/squid
+
+rewrite safesearch {
+        s@(.*\.google\..*/(custom|search|images|groups|news)?.*q=.*)@\1\&safe=active@i
+        s@(.*\..*/yandsearch?.*text=.*)@\1\&fyandex=1@i
+        s@(.*\.yahoo\..*/search.*p=.*)@\1\&vm=r@i
+        s@(.*\.live\..*/.*q=.*)@\1\&adlt=strict@i
+        s@(.*\.msn\..*/.*q=.*)@\1\&adlt=strict@i
+        s@(.*\.bing\..*/search.*q=.*)@\1\&adlt=strict@i
+        log     rewrite.log
+}
+
+{%         if sg_config.local_ok is vyos_defined %}
+{%             set acl.value = acl.value + ' local-ok-default' %}
+dest local-ok-default {
+        domainlist     local-ok-default/domains
+}
+{%         endif %}
+{%         if sg_config.local_ok_url is vyos_defined %}
+{%             set acl.value = acl.value + ' local-ok-url-default' %}
+dest local-ok-url-default {
+        urllist        local-ok-url-default/urls
+}
+{%         endif %}
+{%         if sg_config.local_block is vyos_defined %}
+{%             set acl.value = acl.value + ' !local-block-default' %}
+dest local-block-default {
+        domainlist     local-block-default/domains
+}
+{%         endif %}
+{%         if sg_config.local_block_url is vyos_defined %}
+{%             set acl.value = acl.value + ' !local-block-url-default' %}
+dest local-block-url-default {
+        urllist        local-block-url-default/urls
+}
+{%         endif %}
+{%         if sg_config.local_block_keyword is vyos_defined %}
+{%             set acl.value = acl.value + ' !local-block-keyword-default' %}
+dest local-block-keyword-default {
+        expressionlist local-block-keyword-default/expressions
+}
+{%         endif %}
+
+{%         if sg_config.block_category is vyos_defined %}
+{%             for category in sg_config.block_category %}
+{{ sg_rule(category, sg_config.log, squidguard_db_dir) }}
+{%                 set acl.value = acl.value + ' !' + category + '-default' %}
+{%             endfor %}
+{%         endif %}
+{%         if sg_config.allow_category is vyos_defined %}
+{%             for category in sg_config.allow_category %}
+{{ sg_rule(category, False, squidguard_db_dir) }}
+{%                 set acl.value = acl.value + ' ' + category + '-default' %}
+{%             endfor %}
+{%         endif %}
+{%         if sg_config.source_group is vyos_defined %}
+{%             for sgroup, sg_config in sg_config.source_group.items() %}
+{%                 if sg_config.address is vyos_defined %}
+src {{ sgroup }} {
+{%                     for address in sg_config.address %}
+        ip {{ address }}
+{%                     endfor %}
+}
+
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if sg_config.rule is vyos_defined %}
+{%             for rule, rule_config in sg_config.rule.items() %}
+{%                 for b_category in rule_config.block_category %}
+dest {{ b_category }} {
+        domainlist    {{ b_category }}/domains
+        urllist       {{ b_category }}/urls
+}
+{%                 endfor %}
+
+{%             endfor %}
+{%         endif %}
+acl {
+{%         if sg_config.rule is vyos_defined %}
+{%             for rule, rule_config in sg_config.rule.items() %}
+        {{ rule_config.source_group }} {
+{%                 for b_category in rule_config.block_category %}
+            pass local-ok-1 !in-addr !{{ b_category }} all
+{%                 endfor %}
+        }
+{%             endfor %}
+{%         endif %}
+
+        default {
+{%         if sg_config.enable_safe_search is vyos_defined %}
+            rewrite safesearch
+{%         endif %}
+            pass {{ acl.value }} {{ 'none' if sg_config.default_action is vyos_defined('block') else 'allow' }}
+            redirect 302:http://{{ sg_config.redirect_url }}
+{%         if sg_config.log is vyos_defined %}
+            log blacklist.log
+{%         endif %}
+        }
+}
+{%     endif %}
+{% endif %}
diff --git a/data/templates/squid/squidGuard.conf.tmpl b/data/templates/squid/squidGuard.conf.tmpl
deleted file mode 100644
index 5e877f01f..000000000
--- a/data/templates/squid/squidGuard.conf.tmpl
+++ /dev/null
@@ -1,124 +0,0 @@
-### generated by service_webproxy.py ###
-
-{% macro sg_rule(category, log, db_dir) %}
-{%   set expressions = db_dir + '/' + category + '/expressions' %}
-dest {{ category }}-default {
-        domainlist     {{ category }}/domains
-        urllist        {{ category }}/urls
-{%   if expressions | is_file %}
-        expressionlist {{ category }}/expressions
-{%   endif %}
-{%   if log is vyos_defined %}
-        log            blacklist.log
-{%   endif %}
-}
-{% endmacro %}
-
-{% if url_filtering is vyos_defined and url_filtering.disable is not vyos_defined %}
-{%   if url_filtering.squidguard is vyos_defined %}
-{%     set sg_config = url_filtering.squidguard %}
-{%     set acl = namespace(value='local-ok-default') %}
-{%     set acl.value = acl.value + ' !in-addr' if sg_config.allow_ipaddr_url is not defined else acl.value %}
-dbhome {{ squidguard_db_dir }}
-logdir /var/log/squid
-
-rewrite safesearch {
-        s@(.*\.google\..*/(custom|search|images|groups|news)?.*q=.*)@\1\&safe=active@i
-        s@(.*\..*/yandsearch?.*text=.*)@\1\&fyandex=1@i
-        s@(.*\.yahoo\..*/search.*p=.*)@\1\&vm=r@i
-        s@(.*\.live\..*/.*q=.*)@\1\&adlt=strict@i
-        s@(.*\.msn\..*/.*q=.*)@\1\&adlt=strict@i
-        s@(.*\.bing\..*/search.*q=.*)@\1\&adlt=strict@i
-        log     rewrite.log
-}
-
-{%     if sg_config.local_ok is vyos_defined %}
-{%       set acl.value = acl.value + ' local-ok-default' %}
-dest local-ok-default {
-        domainlist     local-ok-default/domains
-}
-{% endif %}
-{%     if sg_config.local_ok_url is vyos_defined %}
-{%       set acl.value = acl.value + ' local-ok-url-default' %}
-dest local-ok-url-default {
-        urllist        local-ok-url-default/urls
-}
-{% endif %}
-{%     if sg_config.local_block is vyos_defined %}
-{%       set acl.value = acl.value + ' !local-block-default' %}
-dest local-block-default {
-        domainlist     local-block-default/domains
-}
-{% endif %}
-{%     if sg_config.local_block_url is vyos_defined %}
-{%       set acl.value = acl.value + ' !local-block-url-default' %}
-dest local-block-url-default {
-        urllist        local-block-url-default/urls
-}
-{% endif %}
-{%     if sg_config.local_block_keyword is vyos_defined %}
-{%       set acl.value = acl.value + ' !local-block-keyword-default' %}
-dest local-block-keyword-default {
-        expressionlist local-block-keyword-default/expressions
-}
-{% endif %}
-
-{%     if sg_config.block_category is vyos_defined %}
-{%       for category in sg_config.block_category %}
-{{ sg_rule(category, sg_config.log, squidguard_db_dir) }}
-{%         set acl.value = acl.value + ' !' + category + '-default' %}
-{%       endfor %}
-{%     endif %}
-{%     if sg_config.allow_category is vyos_defined %}
-{%       for category in sg_config.allow_category %}
-{{ sg_rule(category, False, squidguard_db_dir) }}
-{%         set acl.value = acl.value + ' ' + category + '-default' %}
-{%       endfor %}
-{%     endif %}
-{%     if sg_config.source_group is vyos_defined %}
-{%       for sgroup, sg_config in sg_config.source_group.items() %}
-{%         if sg_config.address is vyos_defined %}
-src {{ sgroup }} {
-{%           for address in sg_config.address %}
-        ip {{ address }}
-{%           endfor %}
-}
-
-{%         endif %}
-{%       endfor %}
-{%     endif %}
-{%     if sg_config.rule is vyos_defined %}
-{%       for rule, rule_config in sg_config.rule.items() %}
-{%         for b_category in rule_config.block_category%}
-dest {{ b_category }} {
-        domainlist    {{ b_category }}/domains
-        urllist       {{ b_category }}/urls
-}
-{%         endfor %}
-
-{%       endfor %}
-{%     endif %}
-acl {
-{%     if sg_config.rule is vyos_defined %}
-{%       for rule, rule_config in sg_config.rule.items() %}
-        {{ rule_config.source_group }} {
-{%         for b_category in rule_config.block_category%}
-            pass local-ok-1 !in-addr !{{ b_category }} all
-{%         endfor %}
-        }
-{%       endfor %}
-{%     endif %}
-
-        default {
-{%     if sg_config.enable_safe_search is vyos_defined %}
-            rewrite safesearch
-{%     endif %}
-            pass {{ acl.value }} {{ 'none' if sg_config.default_action is vyos_defined('block') else 'allow' }}
-            redirect 302:http://{{ sg_config.redirect_url }}
-{%     if sg_config.log is vyos_defined %}
-            log blacklist.log
-{%     endif %}
-        }
-}
-{%   endif %}
-{% endif %}
diff --git a/data/templates/ssh/sshguard_config.j2 b/data/templates/ssh/sshguard_config.j2
new file mode 100644
index 000000000..58c6ad48d
--- /dev/null
+++ b/data/templates/ssh/sshguard_config.j2
@@ -0,0 +1,27 @@
+### Autogenerated by ssh.py ###
+
+{% if dynamic_protection is vyos_defined %}
+# Full path to backend executable (required, no default)
+BACKEND="/usr/libexec/sshguard/sshg-fw-nft-sets"
+
+# Shell command that provides logs on standard output. (optional, no default)
+# Example 1: ssh and sendmail from systemd journal:
+LOGREADER="LANG=C journalctl -afb -p info -n1 -t sshd -o cat"
+
+#### OPTIONS ####
+# Block attackers when their cumulative attack score exceeds THRESHOLD.
+# Most attacks have a score of 10. (optional, default 30)
+THRESHOLD={{ dynamic_protection.threshold }}
+
+# Block attackers for initially BLOCK_TIME seconds after exceeding THRESHOLD.
+# Subsequent blocks increase by a factor of 1.5. (optional, default 120)
+BLOCK_TIME={{ dynamic_protection.block_time }}
+
+# Remember potential attackers for up to DETECTION_TIME seconds before
+# resetting their score. (optional, default 1800)
+DETECTION_TIME={{ dynamic_protection.detect_time }}
+
+# IP addresses listed in the WHITELIST_FILE are considered to be
+# friendlies and will never be blocked.
+WHITELIST_FILE=/etc/sshguard/whitelist
+{% endif %}
diff --git a/data/templates/ssh/sshguard_whitelist.j2 b/data/templates/ssh/sshguard_whitelist.j2
new file mode 100644
index 000000000..47a950a2b
--- /dev/null
+++ b/data/templates/ssh/sshguard_whitelist.j2
@@ -0,0 +1,7 @@
+### Autogenerated by ssh.py ###
+
+{% if dynamic_protection.allow_from is vyos_defined %}
+{%     for address in dynamic_protection.allow_from %}
+{{ address }}
+{%     endfor %}
+{% endif %}
diff --git a/data/templates/syslog/logrotate.tmpl b/data/templates/syslog/logrotate.j2
index c1b951e8b..c1b951e8b 100644
--- a/data/templates/syslog/logrotate.tmpl
+++ b/data/templates/syslog/logrotate.j2
diff --git a/data/templates/syslog/rsyslog.conf.tmpl b/data/templates/syslog/rsyslog.conf.j2
index 2fb621760..4445d568b 100644
--- a/data/templates/syslog/rsyslog.conf.tmpl
+++ b/data/templates/syslog/rsyslog.conf.j2
@@ -2,9 +2,9 @@
 ## file based logging
 {% if files['global']['marker'] %}
 $ModLoad immark
-{%   if files['global']['marker-interval'] %}
-$MarkMessagePeriod  {{files['global']['marker-interval']}}
-{%   endif %}
+{%     if files['global']['marker-interval'] %}
+$MarkMessagePeriod {{ files['global']['marker-interval'] }}
+{%     endif %}
 {% endif %}
 {% if files['global']['preserver_fqdn'] %}
 $PreserveFQDN on
@@ -15,40 +15,40 @@ $outchannel {{ file }},{{ file_options['log-file'] }},{{ file_options['max-size'
 {% endfor %}
 {% if console is defined and console is not none %}
 ## console logging
-{%   for con, con_options in console.items() %}
+{%     for con, con_options in console.items() %}
 {{ con_options['selectors'] }} /dev/console
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 {% if hosts is defined and hosts is not none %}
 ## remote logging
-{%   for host, host_options in hosts.items() %}
-{%     if host_options.proto == 'tcp' %}
-{%       if host_options.port is defined %}
-{%         if host_options.oct_count is defined %}
+{%     for host, host_options in hosts.items() %}
+{%         if host_options.proto == 'tcp' %}
+{%             if host_options.port is defined %}
+{%                 if host_options.oct_count is defined %}
 {{ host_options.selectors }} @@(o){{ host | bracketize_ipv6 }}:{{ host_options.port }};RSYSLOG_SyslogProtocol23Format
-{%         else %}
+{%                 else %}
 {{ host_options.selectors }} @@{{ host | bracketize_ipv6 }}:{{ host_options.port }}
-{%         endif %}
-{%       else %}
+{%                 endif %}
+{%             else %}
 {{ host_options.selectors }} @@{{ host | bracketize_ipv6 }}
-{%       endif %}
-{%     elif host_options.proto == 'udp' %}
-{%       if host_options.port is defined %}
+{%             endif %}
+{%         elif host_options.proto == 'udp' %}
+{%             if host_options.port is defined %}
 {{ host_options.selectors }} @{{ host | bracketize_ipv6 }}:{{ host_options.port }}{{ ';RSYSLOG_SyslogProtocol23Format' if host_options.oct_count is sameas true }}
-{%       else %}
+{%             else %}
 {{ host_options.selectors }} @{{ host | bracketize_ipv6 }}
-{%       endif %}
-{%     else %}
-{%       if host_options['port'] %}
+{%             endif %}
+{%         else %}
+{%             if host_options['port'] %}
 {{ host_options.selectors }} @{{ host | bracketize_ipv6 }}:{{ host_options.port }}
-{%       else %}
+{%             else %}
 {{ host_options.selectors }} @{{ host | bracketize_ipv6 }}
-{%       endif %}
-{%     endif %}
-{%   endfor %}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
 {% endif %}
 {% if user is defined and user is not none %}
-{%   for username, user_options in user.items() %}
+{%     for username, user_options in user.items() %}
 {{ user_options.selectors }} :omusrmsg:{{ username }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/system/curlrc.tmpl b/data/templates/system/curlrc.j2
index be4efe8ba..be4efe8ba 100644
--- a/data/templates/system/curlrc.tmpl
+++ b/data/templates/system/curlrc.j2
diff --git a/data/templates/system/proxy.j2 b/data/templates/system/proxy.j2
new file mode 100644
index 000000000..215c4c5c2
--- /dev/null
+++ b/data/templates/system/proxy.j2
@@ -0,0 +1,7 @@
+# generated by system-proxy.py
+{% if url is vyos_defined and port is vyos_defined %}
+{# remove http:// prefix so we can inject a username/password if present #}
+export http_proxy=http://{{ username ~ ':' ~ password ~ '@' if username is vyos_defined and password is vyos_defined }}{{ url | replace('http://', '') }}:{{ port }}
+export https_proxy=$http_proxy
+export ftp_proxy=$http_proxy
+{% endif %}
diff --git a/data/templates/system/ssh_config.tmpl b/data/templates/system/ssh_config.j2
index 1449f95b1..1449f95b1 100644
--- a/data/templates/system/ssh_config.tmpl
+++ b/data/templates/system/ssh_config.j2
diff --git a/data/templates/system/sysctl.conf.tmpl b/data/templates/system/sysctl.conf.j2
index 3aa857647..59a19e157 100644
--- a/data/templates/system/sysctl.conf.tmpl
+++ b/data/templates/system/sysctl.conf.j2
@@ -1,7 +1,7 @@
 # autogenerated by system_sysctl.py

 

 {% if parameter is vyos_defined %}

-{%   for k, v in parameter.items() %}

+{%     for k, v in parameter.items() %}

 {{ k }} = {{ v.value }}

-{%   endfor %}

+{%     endfor %}

 {% endif %}

diff --git a/data/templates/tftp-server/default.tmpl b/data/templates/tftp-server/default.j2
index 56784d467..b2676e0aa 100644
--- a/data/templates/tftp-server/default.tmpl
+++ b/data/templates/tftp-server/default.j2
@@ -1,3 +1,4 @@
+{# j2lint: disable=jinja-variable-format #}
 ### Autogenerated by tftp_server.py ###
 DAEMON_ARGS="--listen --user tftp --address {{ listen_address }} {{ "--create --umask 000" if allow_upload is vyos_defined }} --secure {{ directory }}"
 {% if vrf is vyos_defined %}
diff --git a/data/templates/vrf/vrf.conf.tmpl b/data/templates/vrf/vrf.conf.j2
index a51e11ddf..d31d23574 100644
--- a/data/templates/vrf/vrf.conf.tmpl
+++ b/data/templates/vrf/vrf.conf.j2
@@ -3,7 +3,7 @@
 # Routing table ID to name mapping reference
 # id       vrf name         comment
 {% if name is vyos_defined %}
-{%   for vrf, vrf_config in name.items() %}
+{%     for vrf, vrf_config in name.items() %}
 {{ "%-10s" | format(vrf_config.table) }} {{ "%-16s" | format(vrf) }} {{ '# ' ~ vrf_config.description if vrf_config.description is vyos_defined }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
diff --git a/data/templates/zone_policy/nftables.tmpl b/data/templates/zone_policy/nftables.j2
index 9e532b79e..e4c4dd7da 100644
--- a/data/templates/zone_policy/nftables.tmpl
+++ b/data/templates/zone_policy/nftables.j2
@@ -1,113 +1,113 @@
 #!/usr/sbin/nft -f
 
 {% if cleanup_commands is vyos_defined %}
-{%   for command in cleanup_commands %}
+{%     for command in cleanup_commands %}
 {{ command }}
-{%   endfor %}
+{%     endfor %}
 {% endif %}
 
 {% if zone is vyos_defined %}
 table ip filter {
-{%   for zone_name, zone_conf in zone.items() if zone_conf.ipv4 %}
-{%     if zone_conf.local_zone is vyos_defined %}
+{%     for zone_name, zone_conf in zone.items() if zone_conf.ipv4 %}
+{%         if zone_conf.local_zone is vyos_defined %}
     chain VZONE_{{ zone_name }}_IN {
         iifname lo counter return
-{%       for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.name is vyos_defined %}
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.name is vyos_defined %}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME_{{ from_conf.firewall.name }}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%       endfor %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
     chain VZONE_{{ zone_name }}_OUT {
         oifname lo counter return
-{%         for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.name is vyos_defined %}
+{%             for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.name is vyos_defined %}
         oifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME_{{ from_conf.firewall.name }}
         oifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%         endfor %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
-{%     else %}
+{%         else %}
     chain VZONE_{{ zone_name }} {
         iifname { {{ zone_conf.interface | join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6=False) }}
-{%       if zone_conf.intra_zone_filtering is vyos_defined %}
+{%             if zone_conf.intra_zone_filtering is vyos_defined %}
         iifname { {{ zone_conf.interface | join(",") }} } counter return
-{%       endif %}
-{%       for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.name is vyos_defined %}
-{%         if zone[from_zone].local_zone is not defined %}
+{%             endif %}
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.name is vyos_defined %}
+{%                 if zone[from_zone].local_zone is not defined %}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME_{{ from_conf.firewall.name }}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%         endif %}
-{%       endfor %}
+{%                 endif %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
-{%     endif %}
-{%   endfor %}
+{%         endif %}
+{%     endfor %}
 }
 
 table ip6 filter {
-{%   for zone_name, zone_conf in zone.items() if zone_conf.ipv6 %}
-{%     if zone_conf.local_zone is vyos_defined %}
+{%     for zone_name, zone_conf in zone.items() if zone_conf.ipv6 %}
+{%         if zone_conf.local_zone is vyos_defined %}
     chain VZONE6_{{ zone_name }}_IN {
         iifname lo counter return
-{%       for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%       endfor %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
     chain VZONE6_{{ zone_name }}_OUT {
         oifname lo counter return
-{%         for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+{%             for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.ipv6_name is vyos_defined %}
         oifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
         oifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%         endfor %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
-{%     else %}
+{%         else %}
     chain VZONE6_{{ zone_name }} {
         iifname { {{ zone_conf.interface | join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6=True) }}
-{%       if zone_conf.intra_zone_filtering is vyos_defined %}
+{%             if zone_conf.intra_zone_filtering is vyos_defined %}
         iifname { {{ zone_conf.interface | join(",") }} } counter return
-{%       endif %}
-{%       for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
-{%         if zone[from_zone].local_zone is not defined %}
+{%             endif %}
+{%             for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %}
+{%                 if zone[from_zone].local_zone is not defined %}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }}
         iifname { {{ zone[from_zone].interface | join(",") }} } counter return
-{%         endif %}
-{%       endfor %}
+{%                 endif %}
+{%             endfor %}
         counter {{ zone_conf.default_action }}
     }
-{%     endif %}
-{%   endfor %}
+{%         endif %}
+{%     endfor %}
 }
 
-{%   for zone_name, zone_conf in zone.items() %}
-{%     if zone_conf.ipv4 %}
-{%       if 'local_zone' in zone_conf %}
+{%     for zone_name, zone_conf in zone.items() %}
+{%         if zone_conf.ipv4 %}
+{%             if 'local_zone' in zone_conf %}
 insert rule ip filter VYOS_FW_LOCAL counter jump VZONE_{{ zone_name }}_IN
 insert rule ip filter VYOS_FW_OUTPUT counter jump VZONE_{{ zone_name }}_OUT
-{%       else %}
+{%             else %}
 insert rule ip filter VYOS_FW_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }}
-{%       endif %}
-{%     endif %}
-{%     if zone_conf.ipv6 %}
-{%       if 'local_zone' in zone_conf %}
+{%             endif %}
+{%         endif %}
+{%         if zone_conf.ipv6 %}
+{%             if 'local_zone' in zone_conf %}
 insert rule ip6 filter VYOS_FW6_LOCAL counter jump VZONE6_{{ zone_name }}_IN
 insert rule ip6 filter VYOS_FW6_OUTPUT counter jump VZONE6_{{ zone_name }}_OUT
-{%       else %}
+{%             else %}
 insert rule ip6 filter VYOS_FW6_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }}
-{%       endif %}
-{%     endif %}
-{%   endfor %}
+{%             endif %}
+{%         endif %}
+{%     endfor %}
 
 {# Ensure that state-policy rule is first in the chain #}
-{%   if firewall.state_policy is vyos_defined %}
-{%     for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL'] %}
+{%     if firewall.state_policy is vyos_defined %}
+{%         for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL'] %}
 insert rule ip filter {{ chain }} jump VYOS_STATE_POLICY
-{%     endfor %}
-{%     for chain in ['VYOS_FW6_FORWARD', 'VYOS_FW6_OUTPUT', 'VYOS_FW6_LOCAL'] %}
+{%         endfor %}
+{%         for chain in ['VYOS_FW6_FORWARD', 'VYOS_FW6_OUTPUT', 'VYOS_FW6_LOCAL'] %}
 insert rule ip6 filter {{ chain }} jump VYOS_STATE_POLICY6
-{%     endfor %}
-{%   endif %}
+{%         endfor %}
+{%     endif %}
 
 {% endif %}