iptables: drop or reject?