Hello, Is there any reason why it is not possible to use "-m policy --dir out" in PREROUTING? I tried to do something like: -A PREROUTING -m policy --dir out --pol ipsec -j RETURN -A PREROUTING -p tcp -i $IF_LANBR --dport 80 -j REDIRECT --to-ports 8088 Best regards, Krzysztof Olędzki