Ouch... I thought this was just something undocumented (because with ipset + iptables it works perfectly :) I have doubts that this solution will be included in Debian Buster. Probably after the final patch they could ship a patched version (currently 0.9.0)... Thank you Florian for the fast reply. Vladimir Khailenko