anchor.diff:      }
   }
   
  +# Drop policy for ipv6
   # IPv6:
  -#domain ip6 {
  -#    table filter {
  -#        chain INPUT {
  -#            policy ACCEPT;
  -#            # ...
  -#        }
  -#        # ...
  -#    }
  -#}+domain ip6 {
  +    table filter {
  +        chain INPUT {
  +            policy DROP;
  +	    interface lo ACCEPT;
  +        }
  +    }
  +}
positive.code:         # allow the defined tcp connections
          #proto tcp dport ssh ACCEPT;
  				proto tcp dport $SERVER_TCP_PORTS ACCEPT;
      }
      chain OUTPUT {
          policy ACCEPT;
  
negative.code:         interface lo ACCEPT;
  
          # respond to ping, but limit that
          proto icmp ACCEPT;
  
          # allow IPsec
          proto udp dport 500 ACCEPT;
  