I am try to figure out what is the meaning of multiple match like this :- iptables ...... -m state --state NEW -m mark --mark 1 is it a boolean AND of two conditions or is it a boolean OR ? If it is boolean AND, does it mean, iptables ..... -m mark --mark 1 -m state --state NEW .... this is the same as the first ? Similarly I have problem with multiple states comma together, eg :- iptables .... -m state --state NEW,INVALID ...... Does it mean state NEW --and-- INVALID or NEW --or-- INVALID ?