3 files changed, 57 insertions, 4 deletions
diff --git a/data/templates/accel-ppp/pppoe.config.j2 b/data/templates/accel-ppp/pppoe.config.j2
index 6b01958e5..ddf0da518 100644
--- a/data/templates/accel-ppp/pppoe.config.j2
+++ b/data/templates/accel-ppp/pppoe.config.j2
@@ -64,12 +64,13 @@ vlan-mon={{ iface }},{{ iface_config.vlan | join(',') }}
 service-name={{ service_name | join(',') }}
 {% endif %}
 {% if pado_delay %}
-{%     set pado_delay_param = namespace(value='0') %}
-{%     for delay in pado_delay | sort(attribute='0') %}
+{%     set delay_without_sessions = pado_delay.delays_without_sessions[0] | default('0') %}
+{%     set pado_delay_param = namespace(value=delay_without_sessions) %}
+{%     for delay, sessions in pado_delay.delays_with_sessions | sort(attribute='1') %}
 {%         if not loop.last %}
-{%             set pado_delay_param.value = pado_delay_param.value + ',' + delay + ':' + pado_delay[delay].sessions %}
+{%             set pado_delay_param.value = pado_delay_param.value + ',' + delay + ':' + sessions | string %}
 {%         else %}
-{%             set pado_delay_param.value = pado_delay_param.value + ',-1:' + pado_delay[delay].sessions %}
+{%             set pado_delay_param.value = pado_delay_param.value + ',-1:' + sessions | string %}
 {%         endif %}
 {%     endfor %}
 pado-delay={{ pado_delay_param.value }}
diff --git a/data/templates/firewall/nftables-cgnat.j2 b/data/templates/firewall/nftables-cgnat.j2
new file mode 100644
index 000000000..79a8e3d5a
--- /dev/null
+++ b/data/templates/firewall/nftables-cgnat.j2
@@ -0,0 +1,47 @@
+#!/usr/sbin/nft -f
+
+add table ip cgnat
+flush table ip cgnat
+
+add map ip cgnat tcp_nat_map { type ipv4_addr: interval ipv4_addr . inet_service ; flags interval ;}
+add map ip cgnat udp_nat_map { type ipv4_addr: interval ipv4_addr . inet_service ; flags interval ;}
+add map ip cgnat icmp_nat_map { type ipv4_addr: interval ipv4_addr . inet_service ; flags interval ;}
+add map ip cgnat other_nat_map { type ipv4_addr: interval ipv4_addr ; flags interval ;}
+flush map ip cgnat tcp_nat_map
+flush map ip cgnat udp_nat_map
+flush map ip cgnat icmp_nat_map
+flush map ip cgnat other_nat_map
+
+table ip cgnat {
+    map tcp_nat_map {
+        type ipv4_addr : interval ipv4_addr . inet_service
+        flags interval
+        elements = { {{ proto_map_elements }} }
+    }
+
+    map udp_nat_map {
+        type ipv4_addr : interval ipv4_addr . inet_service
+        flags interval
+        elements = { {{ proto_map_elements }} }
+    }
+
+    map icmp_nat_map {
+        type ipv4_addr : interval ipv4_addr . inet_service
+        flags interval
+        elements = { {{ proto_map_elements }} }
+    }
+
+    map other_nat_map {
+        type ipv4_addr : interval ipv4_addr
+        flags interval
+        elements = { {{ other_map_elements }} }
+    }
+
+    chain POSTROUTING {
+        type nat hook postrouting priority srcnat; policy accept;
+        ip protocol tcp counter snat ip to ip saddr map @tcp_nat_map
+        ip protocol udp counter snat ip to ip saddr map @udp_nat_map
+        ip protocol icmp counter snat ip to ip saddr map @icmp_nat_map
+        counter snat ip to ip saddr map @other_nat_map
+    }
+}
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2
index af7f2994e..adfa32bde 100644
--- a/data/templates/ipsec/swanctl/remote_access.j2
+++ b/data/templates/ipsec/swanctl/remote_access.j2
@@ -35,6 +35,11 @@
             auth = {{ rw_conf.authentication.client_mode }}
             eap_id = %any
 {% endif %}
+{% if rw_conf.authentication.client_mode is vyos_defined('eap-tls') or rw_conf.authentication.client_mode is vyos_defined('x509') %}
+{#          pass all configured CAs as filenames, separated by commas #}
+{#          this will produce a string like "MyCA1.pem,MyCA2.pem" #}
+            cacerts = {{ '.pem,'.join(rw_conf.authentication.x509.ca_certificate) ~ '.pem' }}
+{% endif %}
         }
         children {
             ikev2-vpn  {