REJECT parameter*   ==  REJECT=connMap
           connMap  ==  ProtoList:dstHostList:srcHostList
                    --  default: none

REJECT parameter specifies what kind of access is to be rejected in the same syntax with PERMIT. It can be more convenient than PERMIT when cases to be rejected are exceptional and are easier to describe than cases to be permitted.

Example: forbid mail-clients to remove message on mail-servers

REJECT="pop//DELE:mail-server:mail-client"
REJECT="imap//EXPUNGE:mail-server:mail-client"