Hi, I am setting up a firewall with masqrading. I would like to dump all the packages the conntrack regards as INVALID or NEW to one host, so this host can use video conferencing and such programs, but the -j DNAT is only available in the PREROUTING and OUTPUT chains I tried iptables -t nat -A PREROUTING -i ppp0 -m state --state INVALID,NEW \ -j DNAT --to-destination 192.168.2.101 But that didn't work, how can I get this to work? Thanks Alex