@IPCHAINS@ -A output -i @EXTDEV@ -s @EXTIP@ 32769:65535 -d @EXTNET@ 33434:33523 -p udp -j ACCEPT
@IPCHAINS@ -A input -i @EXTDEV@ -s @EXTNET@ -d @EXTIP@ -p icmp --icmp-type time-exceeded -j ACCEPT
@IPCHAINS@ -A input -i @EXTDEV@ -s @EXTNET@ -d @EXTIP@ -p icmp --icmp-type destination-unreachable -j ACCEPT
