An important tip for people migrating from iptables: rules are not applied on a first match basis, but rather last match! I've made several mistakes due to that before..