Use 'INPUT' instead of 'FWR' add NAT suffix, better ICMP rules ALLOW OUTBOUND