+domain ip {
+ table filter {
+ chain log_and_reject {
+ ULOG ulog-prefix "REJECT: ";
+ proto tcp REJECT reject-with tcp-reset;
+ REJECT;
+ }
+
+ chain log_or_drop {
+ mod hashlimit hashlimit-name ulogreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
+ mod hashlimit hashlimit-name uloglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second ULOG ulog-prefix "DROP: ";
+ DROP;
+ }
+
+ }
+}
+domain ip6 {
+ table filter {
+ chain log_and_reject {
+ LOG log-prefix "REJECT: ";
+ proto tcp REJECT reject-with tcp-reset;
+ REJECT;
+ }
+
+ chain log_or_drop {
+ mod hashlimit hashlimit-name logreject hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second jump log_and_reject;
+ mod hashlimit hashlimit-name loglogdrop hashlimit-mode srcip hashlimit-burst 10 hashlimit 1/second LOG log-prefix "DROP: ";
+ DROP;
+ }
+ }
+}