config: drop input traffic by default