{
    # Find the current InboundTCP_$$ chain, and create a new one.
    $OUT .=<<'EOF';
    OLD_InboundTCP=$(get_safe_id InboundTCP filter find)
    NEW_InboundTCP=$(get_safe_id InboundTCP filter new)
    /sbin/iptables --new-chain $NEW_InboundTCP
EOF
    $OUT .= "    /sbin/iptables --append \$NEW_InboundTCP \\! " .
            "--destination \$OUTERNET --jump denylog\n";
}
