at this point, for my own emotional health, i'm going to pretend i don't know about the really weird things you can do regarding policies and just stick with what they're *commonly* used for. thanks to antony for the time he took convincing me that, yes, there really was some weirdness with all of this. i don't think i'll be adding a DROP policy to any of my nat or mangle rules any time soon. rday
