Re: prefix len confusion

     chain wan-in {
         ip saddr $BOGONS4 drop
         ip saddr $EXTv4 daddr $VULN4 accept
         ip saddr $JUMP4 daddr $VULN4 accept
         ip daddr $VULN4 drop
         ip protocol icmp accept
...

Did you mean to do this instead?

You should discriminate about which machines can send forwardable icmp, tho=
ugh.

CONFIDENTIALITY NOTICE: as prior.
SIGNATURE NOTICE: as prior.

Regards,
sunny