Thanks for your answer. But way the first packet only? All packets from <LAN_IP> are marked and all should go to table isp2. Even with per-port load balancing in most services dest. port is always the same and I don't have to use conntrack/connmark (in Slackware). -- Tomek