> Tbh egress filtering is generally not very useful

i found it sensible to log-drop non-internet traffic (rfc1918, linklocal ...) on internet-facing egress