iptables chains don't need an exlicit return at the end, this is the default