jump allowed_sources;

{% endif %}

        }

        # The flood chain is used for controlling the rate of the incoming connections.

        chain flood {

            # Rate-limit the ping requests.

            proto icmp icmp-type echo-request {

                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}

                    hashlimit-mode srcip hashlimit-name icmp RETURN;

                DROP;

            }

            # Rate-limit the TCP connections.

            proto tcp tcp-flags (FIN SYN RST ACK) SYN {

                mod hashlimit hashlimit {{ incoming_connection_limit }} hashlimit-burst {{ incoming_connection_limit_burst }}

                    hashlimit-mode srcip hashlimit-name icmp RETURN;

                LOG;

                DROP;

            }

        }

{% if maintenance %}

        # Resume processing for allowed source addresses, otherwise drop packets.

        chain allowed_sources {

            {% for source in maintenance_allowed_sources %}

            saddr {{ source }} RETURN;

                {% endif %}

            {% endfor %}

            DROP;

        }

{% endif %}

    }

}