%{ for ip in deny_ip }
  deny ${ip};
%{ endfor ~}