Hi! I would like to thank very much for this great page with Kernel Packet Traveling Diagram and to suggest small update concerning IMQ. I think the sentence: "IMQ in input comes before nat so IMQ does not know the real ip address. Ingress comes after nat, so ingress knows the real ip address." could be more precise like that: "By default IMQ in PREROUTING comes before nat and in POSTROUTING after nat, so in both cases IMQ knows ip addresses as masqueraded (nated) if it is used. This could be changed with kernel parameters IMQ_BEHAVIOR_??". My opinion is based on IMQ patch by Patrick McHardy from www.linuximq.net. Best regards, Jarek Poplawski