The default action is typically set to "deny." This means that if a packet doesn't match any policy, it will be denied by default.