On Thu, August 10, 2006 09:55, Costi wrote: > But still isn't iptables *first rule wins* policy ? From what I know > iptables runs with this policy? That depends on the target. If the target is definitive (AFAIK these are: ACCEPT, DROP, REJECT) then subsequent rules will not be processed. A MARK target is not definitive so subsequent rules are processed. Gr, Rob
