Declarations what a file is made of.

version 1
default drop

const game_ports = {27015, 27020-27030}

version 1 must be the first declaration and appear once.

default pass or default drop is required, once. It decides packets that no rule decides.

const NAME = VALUE names a literal, a range or a list. Names share one namespace with sets and rules, and cannot reuse a protocol name or a TCP flag name.

The other declarations have pages of their own: sets and variables, modules and rules.

Diagnostics

Errors stop compilation. Warnings do not, unless moat check --deny-warnings is used. The checker warns about:

• constants and sets that are never used;
• conditions that can never be true;
• rules that never match because an earlier pass or drop rule already handles every packet they could match;
• not around a comparison on a header some packets lack;
• a limit burst smaller than one second of its rate.