It's a mistake, I modified it manualy... should be: 32764: from all fwmark 0x5 lookup isp2 32765: from <LAN_IP> lookup isp2 32766: from all lookup main 32767: from all lookup default But if there were no mark why would it affect the routing? I've logged the packets on FORWARD: iptables -A FORWARD -s $LAN_IP -d $SOME_IP -j LOG and I get the same info when packets are accepted and not. -- Tomek