The additional lines for the firewall rules I put in order to accept only NEW connections.  With the firewall you normally wouldn't want to accept any packets unless they're new connection requests or associated with existing connections (which should be caught by a more general [ACCEPT TCP state=='ESTABLISHED'] rule.  I agree that doesn't have to do with the proposed change in functionality and I can submit a separate pull request if you think that makes sense, or I can just keep it separate in my own repo if you don't want to roll it in.