Thanks for the clarification, I completely missed the point that the router itself is still reachable from all subnets because of the input chain
Thanks for the clarification, I completely missed the point that the router itself is still reachable from all subnets because of the input chain