/REJECT { =[NO]HOSTS=(hosts) | =[NO]NETWORKS=(networks) |

    Optional. Default: No rejections.

    Specifies the hosts or networks that cannot access the TCP/IP
    Services software, including the rejection message that TCP/IP
    might return.

    (For remote login, remote shell, and remote executive, the
    rejection message is preceded by a byte with a value of 1 and
    terminated by a byte with a value of 0.)

    Do not specify the same hosts or networks for both /ACCEPT and
    /REJECT.

    To delete a /REJECT entry, specify it again using the NOHOSTS or
    NONETWORKS option.

    Specify one of the following:

    o  [NO]HOSTS=hosts to list hosts that cannot access TCP/IP
       Services. Maximum is 32. The syntax is:

       /REJECT=HOSTS=(host1_name,host2_name, host3_address)

    o  [NO]NETWORKS=networks to list networks that cannot access
       TCP/IP Services Maximum is 16. The syntax is:

       NETWORKS=(net1[:net1mask],net2[:net2mask],... )

       For each network, specify network:network_mask. The network
       mask is optional. Default: Class number of your network. For
       example, the default for 11.200.0.0. is 255.0.0.0. The syntax
       is:

       /REJECT=NETWORKS=(net1_name,net2_address,net3_addr:net3_mask)