# Basic ferm configuration for GARStow.
# See ferm(1) or @prefix@/share/doc/ferm for more examples.

domain (ip ip6) {
	table filter {
		chain INPUT {
			policy DROP;

			# connection tracking
			mod state state INVALID DROP;
			mod state state (ESTABLISHED RELATED) ACCEPT;

			# allow connections from localhost
			interface lo ACCEPT;

			# allow ICMP
			proto icmp ACCEPT;

			# allow SSH connections
			proto tcp dport ssh ACCEPT;

			# reject anything else
			REJECT;
		}

		chain OUTPUT policy ACCEPT;

		chain FORWARD policy DROP;
	}
}
