Hi, Does the order of match extensions matter for iptables rules? Can someone explain why the following 2 rules produce different results: 1. Matches lots of packets as expected: iptables -t mangle -A FORWARD -i eth0 -m mark ! --mark 99 \ -m state --state NEW -m statistic --mode nth --every 1 -j LOG 2. Does not match any packets: iptables -t mangle -A FORWARD -i eth0 -m state --state NEW \ -m statistic --mode nth --every 1 -m mark ! --mark 99 -j LOG The only difference is the place of the "mark" match (either at the end or the beginning). (Debian iptables v1.4.8) Andy -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
