> Why we shull now use separate programs or Xtables-addons they need more and > must been patched the OS and get a risk, that the host then not runs? I never suggested to use Xtables. Instead, I posted an example here: http://pve.proxmox.com/pipermail/pve-devel/2014-October/013009.html