Jasper Yu
says to
YSITD
drop all from WAN not DSTNATed