added REJECT as last rule for chain