This is a known limitation of iptables:
/* FIXME: This scheme doesn't allow two of the same matches --RR */
*nod* This explains a few things. Thank you for the input.
It looks like fixing it would break compatibility because currently arguments to matches can occur at any position:
Hmm...
I suggest you add the second match to a new chain and jump to it from the first match.
I was afraid that I would have to do such. It looks like I'll be playing with the GOTO target extension then.
Grant. . . .
