The address type check can be limited to the interface the packets belongs to and it matches only if the incoming interface (of the packet) has the same IP address as the packet's source or destination address depending on the source or destionation type settings. - To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html