I think that detection of source/destination mac addresses of a packet is done after NF_IP_POST_ROUTING step of Netfilter. Is it possible to hook the packet after this step with correct mac addrs? I want to decide about the out-going packet from my NIC to another to drop/accept packet. In another way, it is like to a firewall rule on mac addresses of output packets .