Inbound vs outbound

• Each packet that is forwarded is matched twice, once in ip_input() and one in ip_output()

• Adding state on inbound packets skips rule matching on outgoing interface

Notes: