> Not sure, you do a goto PVE_SPECIAL_ACCEPT, so it's finished in > PVE_SPECIAL_ACCEPT. Why do you think it is finished? AFAIK It just return to the caller (of the previous chain) instead. > But how do you go in the in vmbrX-IN, to check destination inbound rules ? I just work on a test setup - will send a patch if it works as expected.