Hello! We can create a set with "ipv4_addr . inet_proto . inet_service": set allow_dns_ntp { type ipv4_addr . inet_proto . inet_service elements = { 1.2.3.4 . tcp . domain, 1.2.3.4 . udp . domain, 5.6.7.8 . udp . ntp } } But how the we can use them? "iifname $nic_wan ip daddr . protocol . dport @allow_dns_ntp ct state new counter accept" - Does not work "iifname $nic_wan ip daddr . ip protocol . tcp dport @allow_dns_ntp ct state new counter accept" - this works, but does not have any sense… Thank you for an advice. Vladimir Khailenko