default reject notify log;

for 128.45.0.0 netmask is 255.255.255.0 ;

from any to host 128.45.3.117 proto icmp accept;
from subnet 128.45.3.0 to subnet 128.45.1.0 accept;

