INPUT_direct chain vs DROP zone