Philip Schaten <philip@xxxxxxxxxxxxxx> wrote: > Hm. OK, I'm going to check whether the TCP packets actually get marked or > are forwarded because of some other rule - there's also the usual There's > also a "ct state related, established accept". ct state established should also catch UDP packets, however.