It is also worth mentioning TRACE target that will dump to logs which exact rule the packet hit, it's invaluable big firewalls.