{
# I'm not certain that this is needed. This should be handled by
# connection tracking - we should only accept GRE packets from
# sites we've already negotiated PPTP connections with.
}    /sbin/iptables --new-chain gre-in
    /sbin/iptables --append INPUT -p 47 -j gre-in
    /sbin/iptables --append INPUT -p 47 -j denylog
    /sbin/iptables --append gre-in ! -d $OUTERNET -j denylog
    /sbin/iptables --append gre-in -j denylog
