I would replace DROP by REJECT. DROP means the system will wait till the packet times out. For outgoing connections this may cause issues as the daemon that sends the unreachable will also wait till the packet times out before continuing