#!/bin/sh

# Disable IPv4 kernel routing/forwarding for this network
iptables -D FORWARD -o \$INTERFACE -d ${network_address}/${global_prefix:-16} -j ACCEPT
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -D FORWARD -o ${internal_interface:-eth0} -d {{.}} -j ACCEPT
{{ end }}{{ end }}

# Prevent spoofing attacks
iptables -D FORWARD -i \$INTERFACE ! -s ${network_address}/${global_prefix:-16} -j DROP
{{ if len "${bgp_routes:-}" }}{{ range "$bgp_routes" | split "," }}iptables -D FORWARD -i \$INTERFACE -s {{.}} -j DROP
{{ end }}{{ end }}