### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
###--------------------------------------------------------------------------
-### Config settings.
-
-## This host isn't a router.
-setconf(forward, 0)
-
-## This host is involved in a routing asymmetry.
-setconf(rp_filter, 0)
-setconf(log_martians, 0)
-
-###--------------------------------------------------------------------------
### fender-specific rules.
-m4_divert(82)m4_dnl
+m4_divert(86)m4_dnl
## Externally visible services.
allowservices inbound tcp \
ssh \
## We have to provide NTP service. The guests sync to our clock.
ntpclient inbound $ntp_servers
+## Guaranteed black hole. Put this at the very front of the chain.
+run iptables -I INPUT -d 212.13.198.78 -j DROP
+run ip6tables -I INPUT -d 2001:ba8:0:1d9::ffff -j DROP
+
m4_divert(-1)
###----- That's all, folks --------------------------------------------------