Harald Welte wrote: > > this sounds like you're missing support for the tcp/udp match. > This functionality is implemented in xt_tcpudp.{c,ko}, which is compiled > as soon as x_tables is compiled. Loading 'xt_tcpudp' module solves the problem. Thanks for the answer. So, the problem was just that the new 'x_tables' module is loaded automatically according to modules dependencies, but 'xt_tcpudp' is not. As a result, an upgrade of the FullPliant user land tools is required in order to force the 'xt_tcpudp' module to load before calling 'iptables' with '--destination-port' option.