add log/drop rule

[dsa-puppet.git] / modules / ferm / manifests / init.pp

diff --git a/modules/ferm/manifests/init.pp b/modules/ferm/manifests/init.pp
index 3d35bae0c97df9a55a548219ba47e7bb362cc828..f5dd60f73fb68cb54f7e1d92bc9c8ff2951ce416 100644 (file)
--- a/modules/ferm/manifests/init.pp
+++ b/modules/ferm/manifests/init.pp
@@ -43,6 +43,14 @@ class ferm {
                         notify  => Exec["ferm restart"];
         }
 
+        ferm::rule {
+                domain          => "(ip ip6)",
+                description     => "Drop everything else",
+                prio            => "99",
+                rule            => "jump log_or_drop"
+        }
+
+
         exec { "ferm restart":
                 command     => "/etc/init.d/ferm restart",
                 refreshonly => true,