Default-action for rule-set drop accept drop Drop if no prior rules are hit accept Accept if no prior rules are hit (drop|accept) accept