add log/drop rule

[mirror/dsa-puppet.git] / modules / ferm / manifests / init.pp

diff --git a/modules/ferm/manifests/init.pp b/modules/ferm/manifests/init.pp
index 3d35bae..f5dd60f 100644 (file)
--- a/modules/ferm/manifests/init.pp
+++ b/modules/ferm/manifests/init.pp
@@ -43,6 +43,14 @@ class ferm {
                         notify  => Exec["ferm restart"];
         }
 
+        ferm::rule {
+                domain          => "(ip ip6)",
+                description     => "Drop everything else",
+                prio            => "99",
+                rule            => "jump log_or_drop"
+        }
+
+
         exec { "ferm restart":
                 command     => "/etc/init.d/ferm restart",
                 refreshonly => true,