# Modules

> The standard modules that ship with moat: std.bogons, std.private_sources, std.amplification and std.tcp_sanity, what each one drops and when to use it.

Source: https://moatfw.dev/docs/modules

`use std.NAME` inserts the rules of a standard module at that place, so
they take part in first-match order like any other rule. Their names are
`std.NAME.RULE`. `moat std list` and `moat std show NAME` print them.

| Module | Drops |
|--------|-------|
| `std.bogons` | Sources that are never valid on the wire: loopback, documentation, benchmarking, multicast and reserved ranges, IPv4 and IPv6. Link-local, unique local and the unspecified address are kept, since hosts need them. Safe on cloud VMs. |
| `std.private_sources` | Private, shared, link-local and 0.0.0.0/8 sources, and IPv6 unique local. Only for an interface with a public address and nothing private behind it. |
| `std.amplification` | UDP answers from services abused for reflection arriving on ports below 32768. DNS, NTP, NetBIOS, RIP, mDNS and SSDP between their own ports, and SNMP traps, are allowed. |
| `std.tcp_sanity` | NULL, Xmas, SYN+FIN, SYN+RST, FIN+RST and FIN without ACK. |

> `std.amplification` assumes the host's own clients receive answers on
> ports from 32768 up, the Linux default. Do not use it with a resolver
> that picks lower ports, such as unbound, or with a lowered
> `ip_local_port_range`.