read iptables man page
invent things to manage firewalls which ALSO keep state somewhere so things can get out of sync by yet something else meddling in the firewall