diff --git a/README.rst b/README.rst
index 1a2d8e1..19e037c 100644
--- a/README.rst
+++ b/README.rst
@@ -18,6 +18,7 @@
           chain:
             INPUT:
               enabled: true
+              policy: DROP
               rule:
                 httpd:
                   position: 1
diff --git a/iptables/service.sls b/iptables/service.sls
index f126bd2..ebccf0a 100644
--- a/iptables/service.sls
+++ b/iptables/service.sls
@@ -15,7 +15,14 @@
     - pkg: iptables_packages
 
 {%- for chain_name, chain in service.get('chain', {}).iteritems() %}
- 
+
+{%- if chain.policy is defined %}
+iptables_{{ chain_name }}_policy:
+  iptables.set_policy:
+    - chain: {{ chain_name }}
+    - policy: {{ chain.policy }}
+{%- endif %}
+
 {%- for rule_name, rule in chain.get('rule', {}).iteritems() %}
 
 iptables_{{ chain_name }}_{{ rule_name }}: