iptables где-то теряются пакеты... Помогите найти!

root@gateway:~# ip r
default via 192.168.9.1 dev p2p1 
...
94.247.xx.xx/30 dev p3p2  proto kernel  scope link  src 94.247.xx.xx 
192.168.11.0/24 dev p1p1  proto kernel  scope link  src 192.168.11.1
...

root@gateway:~# iptables -vnL
Chain INPUT (policy ACCEPT 85 packets, 8632 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   20  5568 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            /* Разрешить входящий icmp трафик */
    0     0 ACCEPT     tcp  --  p3p2   *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443,8443 /* Разрешить входящий web трафик на интерфейсе Второй провайдер */
   27  2522 REJECT     all  --  p3p2   *       0.0.0.0/0            0.0.0.0/0            /* Запретить входящий трафик на интерфейсе Второй провайдер */ reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 25074 packets, 26M bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 115 packets, 20283 bytes)
 pkts bytes target     prot opt in     out     source               destination 

root@gateway:~# iptables -vnL -t nat
Chain PREROUTING (policy ACCEPT 63 packets, 6008 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    13    656 LOG        tcp  --  p3p2   *       0.0.0.0/0            0.0.0.0/0            LOG flags 0 level 4 prefix "videosrv:"
    6     304 DNAT       tcp  --  p3p2   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8443 to:192.168.11.127

Chain INPUT (policy ACCEPT 4 packets, 661 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1 packets, 72 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 53 packets, 4783 bytes)
 pkts bytes target     prot opt in     out     source               destination  

root@gateway:~# ip a
...
2: p1p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 10:fe:ed:02:5b:29 brd ff:ff:ff:ff:ff:ff
    inet 192.168.11.1/24 brd 192.168.11.255 scope global p1p1
...
6: p3p2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 10:fe:ed:02:93:40 brd ff:ff:ff:ff:ff:ff
    inet 94.247.xx.xx/30 brd 94.247.xx.xx scope global p3p2
       valid_lft forever preferred_lft forever
    inet6 fe80::12fe:edff:fe02:9340/64 scope link 
       valid_lft forever preferred_lft forever
8: p2p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 192.168.9.2/24 brd 192.168.9.255 scope global p2p1

telnet 94.247.xx.xx 8443

root@gateway:~# tailf /var/log/syslog|grep video
Jul 22 10:29:11 gateway kernel: [1359597.842376] videosrv:IN=p3p2 OUT= MAC=10:fe:ed:02:93:40:00:15:17:28:6a:81:08:00 SRC=194.88.xx.xx DST=94.247.xx.xx LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=3955 DF PROTO=TCP SPT=58214 DPT=8443 WINDOW=8192 RES=0x00 SYN URGP=0 
...

root@gateway:~# tcpdump -i p1p1 dst host 192.168.11.127 and port 8443
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on p1p1, link-type EN10MB (Ethernet), capture size 65535 bytes
^C
0 packets captured
3 packets received by filter
0 packets dropped by kernel