put a forwarding drop in the right place

Forward chains should only DROP in the FORW_OUT, much the same way ACCEPT only accepts in the FORW_OUT chain, so that packets that get ACCEPTed in later blocks don't get DROPped early.

Thanks to Emmanuel for finding the bug and the test case.