i got the following ruleset for restricting web surfing Code: iptables -N webfilter iptables -I FORWARD -i br0 -p tcp -m webstr --url . -j webfilter iptables -A webfilter -i br0 -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT iptables -A webfilter -i br0 -m webstr --url "yahoo.com< >" -j ACCEPT iptables -A webfilter -i br0 -p tcp --dport 80 -j DROP and this for blocking all except some special ports Code: iptables -A lan2wan -m mac --mac-source 00:xx:xx:xx:xx:4D -j ACCEPT iptables -A lan2wan -p tcp --dport 21 -j ACCEPT iptables -A lan2wan -p tcp --dport 110 -j ACCEPT iptables -A lan2wan -p tcp --dport 25 -j ACCEPT iptables -A lan2wan -p tcp --dport 53 -j ACCEPT iptables -A lan2wan -p udp --dport 53 -j ACCEPT iptables -A lan2wan -j DROP (so the mac address 00:xx:xx:xx:xx:4D is fully open with no restriction) but codes works, but just one at a time, if i insert all rules, it stops working, not sure why the lan2wan rule is blocking all the webpages (even yahoo.com) when suppostly the webfilter chain is first, and it should hit the ACCEPT and pass the packet. Any idea what am I doing wrong? Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 21 11147 webfilter tcp -- br0 * 0.0.0.0/0 0.0.0.0/0 WEBSTR match url . 0 0 ACCEPT all -- br0 br0 0.0.0.0/0 0.0.0.0/0 0 0 logdrop all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID 0 0 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 tcpmss match 1461:65535 TCPMSS set 1460 349 23552 lan2wan all -- br0 * 0.0.0.0/0 0.0.0.0/0 410 166K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT udp -- vlan1 * 0.0.0.0/0 224.0.0.0/4 udp 0 0 TRIGGER all -- vlan1 br0 0.0.0.0/0 0.0.0.0/0 TRIGGER type:in match:0 relate:0 5 269 trigger_out all -- br0 * 0.0.0.0/0 0.0.0.0/0 5 269 ACCEPT all -- br0 * 0.0.0.0/0 0.0.0.0/0 state NEW 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0