I do appreciate your following up on this.

I have learned a lot since the original post. There still are gaps, however.

#1 above prevents a person from just putting 127.0.0.1:8118 into their browser proxy settings and effectively bypassing dansguardian filtering. Although I didn't know what it was doing before, it was I nice little tip I learned from using dansguardian with firehol.

#2 another forum said that there can be other broadcasts regarding localhost that are NOT from 127.0.0.1 and this rule changes it to the loopback address. My system works without this line, so I'm not 100% sure what this is trying to do. I know WHAT it is doing, but not the rationale why. Perhaps it prevents some kind of circular routing since only 127.0.0.1 traffic is allowed dport 80 traffic all other is redirected to 8080 where dansguardian is listening so it can do the content filtering but there may be some legit lo traffic on another ip#.

#4 is dropping broadcast packets, but I'm not exactly sure where those would come from. #4 and #5 I have found on other sites that on networks with Windows systems on them, there will be a lot of broadcast and multicast packets on them that will hog the logs, so it just drops them. Does this make since? If not, other explainations are welcome. Not sure what Windows is doing here, but it seems to be in some of the "best practices" info on firewall building.

#6 I understand the difference, but wonder why sometimes things are just dropped (and therefore silent) and if everything makes it through the rules to this point, it might be chosen to use are REJECT and thus send back a TCP RST packet alerting them that they got a "live" system. Just curious on this one.