A user requests a web page. He’s redirected to the proxy. The proxy requests the web page from the web server, this happens in the output chain and the traffic is marked as “established”. The web server replies - this happens in the “input” chain, since the web server talks to the proxy, which sits on the router itself. If you don’t permit established traffic, the web server reply is thrown away.