if you mix <ip> rules and <tcp> rules. Setting a TCP rule adds an early rule to ebtables that ends up overriding the <ip> rules which are last in that table.