strange behavior of connlimit matching rules

[Bernd Strebel <b.strebel@digitec.de>]

Along with the implementation of a simple rule set ( ACCEPT connections 
if ! --connlimit-above nan LOG connections if --connlimit-above n) we 
experienced a strange behavior of the connlimit matching module:

Rule #m:   ...-m connlimit   --connlimit-above n -j LOG
Rule #m+1: ...-m connlimit ! --connlimit-above n -j ACCEPT

works fine, while

Rule #m:   ...-m connlimit ! --connlimit-above n -j ACCEPT
Rule #m+1: ...-m connlimit   --connlimit-above n -j LOG

works not (no match on rule #m+1).

Many thanks for any explanation.
Bernd


environment: kernel 2.4.26, iptables 1.2.9, pomng-20040302
============

iptables output (source/dest. stripped, always 0.0.0.0/0)
===============

Chain OUTPUT (policy DROP 9 packets, 560 bytes): OK

num   pkts bytes target     prot opt in     out

1      131  9331 ACCEPT     all  --  *      lo

2      116 11140 ACCEPT     all  --  *      *
        state RELATED,ESTABLISHED

3        5   260 LOG        tcp  --  *      eth0
        mport dports 22 #conn/32 > 2 state NEW
        LOG flags 0 level 4 prefix CONNLIMIT

4        5   260 ACCEPT     tcp  --  *      eth0
        mport dports 22 #conn/32 < 2 state NEW

5        9   560 LOG        all  --  *      *
        LOG flags 0 level 4 prefix DROP-AT-END-OF-CHAIN


Chain OUTPUT (policy DROP 10 packets, 612 bytes): CONNLIMIT not logged!

num   pkts bytes target     prot opt in     out

1      138  9950 ACCEPT     all  --  *      lo

2      124 11648 ACCEPT     all  --  *      *
        state RELATED,ESTABLISHED

3        0     0 ACCEPT     tcp  --  *      eth0
        mport dports 22 #conn/32 < 2 state NEW

4        0     0 LOG        tcp  --  *      eth0
        mport dports 22 #conn/32 > 2 state NEW
        LOG flags 0 level 4 prefix CONNLIMIT

5       10   612 LOG        all  --  *      *
        LOG flags 0 level 4 prefix DROP-AT-END-OF-CHAIN