<policy target="REJECT">
{% for address in exam_destination_allowed_ipv4 %}
<rule family="ipv4">
<destination address="{{ address }}"/>
<accept/>
</rule>
{% endfor %}
<ingress-zone name="{{ item }}"/>
<egress-zone name="ANY"/>
</policy>
