Also, look into state and connection tracking in your iptables rules.