Hi, I guess this won't work because if you connection is established it will be stored in a TCP State table which is used for filtering and forwarding. If you connection already exists it makes no sense to check it against all rules from the ruleset. UDP doesn't have a statetable (cuz it's stateless) and that is the reason why this works. wlet -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
