#
# Unless you have very specific reasons you should not change this file
#

global:
  policy:
    ip:
      filter:
        INPUT: DROP
        FORWARD: DROP
        OUTPUT: DROP
    ip6:
      filter:
        INPUT: DROP
        FORWARD: DROP
        OUTPUT: DROP
  helper_chains:
    ip:
      filter:
        CUSTOM_REJECT:
          - -p tcp -j REJECT --reject-with tcp-reset
          - -j REJECT --reject-with icmp-port-unreachable
  rules:
    default:
      ip:
        filter:
          INPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -i lo -j ACCEPT
          FORWARD:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
          OUTPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -o lo -j ACCEPT
      ip6:
        filter:
          INPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -i lo -j ACCEPT
          FORWARD:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
          OUTPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -o lo -j ACCEPT

#
# Unless you have very specific reasons you should not change this file
#

global:
  policy:
    ip:
      filter:
        INPUT: DROP
        FORWARD: DROP
        OUTPUT: DROP
    ip6:
      filter:
        INPUT: DROP
        FORWARD: DROP
        OUTPUT: DROP
  helper_chains:
    ip:
      filter:
        CUSTOM_REJECT:
          - -p tcp -j REJECT --reject-with tcp-reset
          - -j REJECT
    ip6:
      filter:
        CUSTOM_REJECT:
          - -p tcp -j REJECT --reject-with tcp-reset
          - -j REJECT
  rules:
    default:
      ip:
        filter:
          INPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -i lo -j ACCEPT
          FORWARD:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
          OUTPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -o lo -j ACCEPT
      ip6:
        filter:
          INPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -i lo -j ACCEPT
          FORWARD:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
          OUTPUT:
            - -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
            - -o lo -j ACCEPT

Add helper chain to ip6 too
Add helper chain to ip6 too
