Oh, I didn't understand the configuration. Hmmm again. I would really expect the http and ssh connections to behave the same.
Yep, thats the point. but they don't.
I have not followed this whole thread, so if this idea has been suggested already please feel free to /dev/null this.
My experience has been that most SSH clients issue a keep alive while HTTP does not. If your accept rule is based on IP and port number only (in other words, you are not doing a --tcp-flags ALL SYN), its possible that the outbound ACK from the client is recreating the session in the state table.
Easy way to check this would be to write your SSH rule with the above switch. If SSH starts acting like HTTP (no longer re-creates the state table entry) then you know this is it.
HTH, C
