nft-blackhole.j2

table inet blackhole {
        set whitelist-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set whitelist-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        set blacklist-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set blacklist-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        set country-v4 {
                type ipv4_addr
                flags interval
                auto-merge
        }

        set country-v6 {
                type ipv6_addr
                flags interval
                auto-merge
        }

        chain input {
                type filter hook input priority -1; policy {{default_policy}};
                iifname lo accept
                ct state established,related accept
                ip saddr @whitelist-v4 counter accept
                ip6 saddr @whitelist-v6 counter accept
                ip saddr @blacklist-v4 counter {{block_policy}}
                ip6 saddr @blacklist-v6 counter {{block_policy}}
                {% if country_exclude_ports_rule %}
                {{country_exclude_ports_rule}}
                {% endif %}
                ip saddr @country-v4 counter {{country_policy}}
                ip6 saddr @country-v6 counter {{country_policy}}
        }
        {% if chain_output %}

        {{chain_output}}
        {% endif %}
}