21:48 < abaddon> any idea why could established packets inside a openvz VPS
                 running shorewall on debian etch wont match the established
                 rule but will match INVALID
21:48 < abaddon> established as in outgoing tcp via netcat or ping, im seeing
                 them in counters going to the INVALID definition, and not
                 matching the established rule
21:49 < abaddon> also shorewall doesnt say any error on start, the host system
                 runs same config so all iptables modules are available