Thanks for this. I had always thought IP tables were actively useful by default.