From ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19 Mon Sep 17 00:00:00 2001
From: sarthurdev <965089+sarthurdev@users.noreply.github.com>
Date: Wed, 10 Sep 2025 10:44:15 +0200
Subject: wlb: T114: Add firewall group support for WAN load balancer

---
 python/vyos/wanloadbalance.py | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

(limited to 'python')

diff --git a/python/vyos/wanloadbalance.py b/python/vyos/wanloadbalance.py
index 158ee76c8..afe005731 100644
--- a/python/vyos/wanloadbalance.py
+++ b/python/vyos/wanloadbalance.py
@@ -67,6 +67,45 @@ def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight
                 port = port[1:]
             output.append(f'th {prefix}port {operator} {{ {port} }}')
 
+        if 'group' in direction_conf:
+                group = direction_conf['group']
+                if 'address_group' in group:
+                    group_name = group['address_group']
+                    operator = ''
+                    exclude = group_name[0] == "!"
+                    if exclude:
+                        operator = '!='
+                        group_name = group_name[1:]
+                    output.append(f'ip {prefix}addr {operator} @A_{group_name}')
+                if 'network_group' in group:
+                    group_name = group['network_group']
+                    operator = ''
+                    if group_name[0] == "!":
+                        operator = '!='
+                        group_name = group_name[1:]
+                    output.append(f'ip {prefix}addr {operator} @N_{group_name}')
+                # Generate firewall group domain-group
+                if 'domain_group' in group:
+                    group_name = group['domain_group']
+                    operator = ''
+                    if group_name[0] == '!':
+                        operator = '!='
+                        group_name = group_name[1:]
+                    output.append(f'ip {prefix}addr {operator} @D_{group_name}')
+                if 'port_group' in group:
+                    proto = rule_conf['protocol']
+                    group_name = group['port_group']
+
+                    if proto == 'tcp_udp':
+                        proto = 'th'
+
+                    operator = ''
+                    if group_name[0] == '!':
+                        operator = '!='
+                        group_name = group_name[1:]
+
+                    output.append(f'{proto} {prefix}port {operator} @P_{group_name}')
+
     if 'source_based_routing' not in rule_conf and not restore_mark:
         output.append('ct state new')
 
-- 
cgit v1.2.3