If you want to drop all non-local subnet originated traffic, you need to keep state. Otherwise, how can you tell which side originated the flow? Even that is o

If you want to drop all non-local subnet originated traffic, you need to keep state. Otherwise, how can you tell which side originated the flow? Even that is only a partial solution - UPNP hole punching exploits holes in this logic to allow peer-to-peer traffic into a network which otherwise has a default-deny ACL.