#!/usr/sbin/nft -f

{% if firewall_sets.v4 is vyos_defined %}
{%     for setname, ip_list in firewall_sets.v4.items() %}
flush set ip vyos_filter {{ setname }}
{%     endfor %}

table ip vyos_filter {
{%     for setname, ip_list in firewall_sets.v4.items() %}
    set {{ setname }} {
        type ipv4_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}

{% if firewall_sets.v6 is vyos_defined %}
{%     for setname, ip_list in firewall_sets.v6.items() %}
flush set ip6 vyos_filter {{ setname }}
{%     endfor %}

table ip6 vyos_filter {
{%     for setname, ip_list in firewall_sets.v6.items() %}
    set {{ setname }} {
        type ipv6_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}


{% if policy_sets.v4 is vyos_defined %}
{%     for setname, ip_list in policy_sets.v4.items() %}
flush set ip vyos_mangle {{ setname }}
{%     endfor %}

table ip vyos_mangle {
{%     for setname, ip_list in policy_sets.v4.items() %}
    set {{ setname }} {
        type ipv4_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}

{% if policy_sets.v6 is vyos_defined %}
{%     for setname, ip_list in policy_sets.v6.items() %}
flush set ip6 vyos_mangle {{ setname }}
{%     endfor %}

table ip6 vyos_mangle {
{%     for setname, ip_list in policy_sets.v6.items() %}
    set {{ setname }} {
        type ipv6_addr
        flags interval
        elements = { {{ ','.join(ip_list) }} }
    }
{%     endfor %}
}
{% endif %}