1 files changed, 71 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables-policy.j2 b/data/templates/firewall/nftables-policy.j2
new file mode 100644
index 0000000..9e28899
--- /dev/null
+++ b/data/templates/firewall/nftables-policy.j2
@@ -0,0 +1,71 @@
+#!/usr/sbin/nft -f
+
+{% import 'firewall/nftables-defines.j2' as group_tmpl %}
+
+{% if first_install is not vyos_defined %}
+delete table ip vyos_mangle
+delete table ip6 vyos_mangle
+{% endif %}
+table ip vyos_mangle {
+    chain VYOS_PBR_PREROUTING {
+        type filter hook prerouting priority -150; policy accept;
+{% if route is vyos_defined %}
+{%     for route_text, conf in route.items() if conf.interface is vyos_defined %}
+        iifname { {{ conf.interface | join(",") }} } counter jump VYOS_PBR_UD_{{ route_text }}
+{%     endfor %}
+{% endif %}
+    }
+
+    chain VYOS_PBR_POSTROUTING {
+        type filter hook postrouting priority -150; policy accept;
+    }
+
+{% if route is vyos_defined %}
+{%     for route_text, conf in route.items() %}
+    chain VYOS_PBR_UD_{{ route_text }} {
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('route', route_text, rule_id, 'ip') }}
+{%             endfor %}
+{%         endif %}
+{%         if conf.default_log is vyos_defined %}
+        counter log prefix "[ipv4-{{ (route_text)[:19] }}-default]"
+{%         endif %}
+    }
+{%     endfor %}
+{% endif %}
+
+{{ group_tmpl.groups(firewall_group, False, True) }}
+}
+
+table ip6 vyos_mangle {
+    chain VYOS_PBR6_PREROUTING {
+        type filter hook prerouting priority -150; policy accept;
+{% if route6 is vyos_defined %}
+{%     for route_text, conf in route6.items() if conf.interface is vyos_defined %}
+        iifname { {{ ",".join(conf.interface) }} } counter jump VYOS_PBR6_UD_{{ route_text }}
+{%     endfor %}
+{% endif %}
+    }
+
+    chain VYOS_PBR6_POSTROUTING {
+        type filter hook postrouting priority -150; policy accept;
+    }
+
+{% if route6 is vyos_defined %}
+{%     for route_text, conf in route6.items() %}
+    chain VYOS_PBR6_UD_{{ route_text }} {
+{%         if conf.rule is vyos_defined %}
+{%             for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
+        {{ rule_conf | nft_rule('route6', route_text, rule_id, 'ip6') }}
+{%             endfor %}
+{%         endif %}
+{%         if conf.default_log is vyos_defined %}
+        counter log prefix "[ipv6-{{ (route_text)[:19] }}-default]"
+{%         endif %}
+    }
+{%     endfor %}
+{% endif %}
+
+{{ group_tmpl.groups(firewall_group, True, True) }}
+}