A packet goes through the chain's rules from top to bottom, and the rule that stopped it shows in its counter.
A rule is conditions plus an action, the verdict. ip saddr 192.0.2.20 tcp dport 8081 accept means: let a packet from 192.0.2.20 to TCP port 8081 through. The first rule whose conditions match decides the packet's fate, and it goes no further. drop discards the packet silently, so the client waits until the timeout; reject sends back a refusal.
If no rule decides, the chain policy applies: policy drop in the chain's first line. The word counter in a rule counts the matching packets: the counter shows which rule fired.
Server rulesets usually have ct state established,related accept as the second rule: it lets through the packets of connections that are already open.
The client has two addresses, 192.0.2.20 and 192.0.2.30. The curl --interface option picks the one a request leaves from.
Which rule fired
Send a request from the client address 192.0.2.20 and read the lab_filter table on the server: which rule counted the request?
First, predict
The request from 192.0.2.20 goes to port 8080. Which rule's counter will grow?
Now start the exercise, run the command and compare your prediction with the output.