> You are rigth. FirewallSimulator was not adapted to this new chain. > I've added this workarround: Thanks, but I still think adding a FORWARD chain is the wrong way, because you can do the same thing with security groups. Did you already tried it?