anchor.diff:          interface lo ACCEPT;
   
           # respond to ping, but limit that
  -        proto icmp ACCEPT; 
  +        proto icmp ACCEPT;
   
           # allow IPsec
           proto udp dport 500 ACCEPT;
  
positive.code:         # allow the defined tcp connections
          #proto tcp dport ssh ACCEPT;
  				proto tcp dport $SERVER_TCP_PORTS ACCEPT;
      }
      chain OUTPUT {
          policy ACCEPT;
  
negative.code:     }
  }
  
  # Drop policy for ipv6
  # IPv6:
  domain ip6 {
      table filter {
          chain INPUT {
              policy DROP;
  	    interface lo ACCEPT;
          }
      }
  }