11.1Sdarrenrpass in proto tcp all flags S keep state(icmp-head icmpredir) 21.1Sdarrenrblock out proto icmp all icmp-type redir group icmpredir 3