RFC: nwfilter rule direction clarification

Hi, all! For next nwfilter: <filter name='test' chain='root'> <rule action='return' direction='out' priority='1'> <tcp dstportstart='22' dstportend='22'/> </rule> </filter> I got next result: -A FI-vmec437726363e0 -p tcp -m tcp --sport 22 -j RETURN -A FO-vmec437726363e0 -p tcp -m tcp --dport 22 -j RETURN -A HI-vmec437726363e0 -p tcp -m tcp --sport 22 -j RETURN -A libvirt-host-in -m physdev --physdev-in vmec437726363e0 -g HI-vmec437726363e0 -A libvirt-in -m physdev --physdev-in vmec437726363e0 -g FI-vmec437726363e0 -A libvirt-in-post -m physdev --physdev-in vmec437726363e0 -j ACCEPT -A libvirt-out -m physdev --physdev-out vmec437726363e0 --physdev-is-bridged -g FO-vmec437726363e0 It is not clear to me why the rule is added to FI-* chains. I guess this filter is supposed to filter only outgoing traffic. I tested with libvirt-5.6.0 but AFAIU the behaviour in upstream is the same. Also looks like this behaviour exists for a long time so I doubted it is a bug. Nikolay