firewall: disable forwarding for mgmt interfaces in if-pre-up

Should be more robust and more importantly works when interfaces are
not renamed by mdev as is the situation now.

roles/firewall/templates/mgmt.intf.j2

@@ -11,6 +11,8 @@ iface {{ iface.name }}
     requires {{ iface.vrf.name }}
     pre-up ip link set $IFACE master {{ iface.vrf.name }}
 {% endif %}
+    pre-up sysctl -w net.ipv4.conf.$IFACE.forwarding=0
+    pre-up sysctl -w net.ipv6.conf.$IFACE.forwarding=0
 {% if iface.mtu %}
     mtu {{ iface.mtu }}
 {% endif %}

roles/firewall/templates/sysctl.conf.j2

@@ -2,12 +2,6 @@
 net.ipv4.ip_forward = 1
 net.ipv6.conf.all.forwarding = 1
 
-# But not for management interfaces.
-{% for iface in interfaces | selectattr('name', 'match', '^mgmt') %}
-net.ipv4.conf.{{ iface.name }}.forwarding = 0
-net.ipv6.conf.{{ iface.name }}.forwarding = 0
-{% endfor %}
-
 # Zebra docs recommend these.
 net.ipv6.conf.all.keep_addr_on_down = 1
 net.ipv6.route.skip_notify_on_dev_down = 1