Maybe only us B rexit Bods ... View more

Just one thing to add to this;   there's only an implicit allow if the packet is received on a LAN interface.  If it's on a WAN / Internet port (with no matching outbound session), it hits an implicit deny - of course! ... View more