Now, hopefully, if it's clever, it will only allow the same remote IP as the packet's source IP.

So it needs to allocate memory, to start some record-keeping, to record the sequence number from that remote IP and that remote port which is coming into it.

So it would be impossible for your computer to contact that remote IP you're wanting to prevent.

But if you had an outbound dialogue with a given remote IP, and you got an ICMP echo request from them, then it would respond.

It knows the local IP and port and the remote IP and port.

And when I'm probing a remote IP, I'm looking for any traffic of any sort coming back from that IP.

So the browser connects directly to there, to its remote IP, and that standard web surfing port 80.

But the idea is that the packet is addressed to a remote IP but sent to the gateway.

Well, that means it has a remote IP which we know cannot be spoofed.

The idea being that a remote IP could have different services listening on different ports for incoming TCP connections.