jaclaz
3
Use the actual default firewall, see Rule #8 here:
in the corollary there is a link to the default firewall that you should be using, at least initially.
These two:
add action=accept chain=forward comment="allow LAN out"
add action=drop chain=forward comment="drop everything else"
make little sense (to me) you are accepting EVERYTHING and then dropping WHATEVER REMAINS after that (nothing).