diff --git a/ebtables.c b/ebtables.c
index d4c6a6b..c58c0c6 100644
--- a/ebtables.c
+++ b/ebtables.c
@@ -1451,6 +1451,33 @@
 	return 0;
 }
 
+void do_final_checks(struct ebt_u_entry *e, struct ebt_u_entries *entries)
+{
+	struct ebt_u_match_list *m_l;
+	struct ebt_u_watcher_list *w_l;
+	struct ebt_u_target *t;
+	struct ebt_u_match *m;
+	struct ebt_u_watcher *w;
+
+	m_l = e->m_list;
+	w_l = e->w_list;
+	while (m_l) {
+		m = find_match(m_l->m->u.name);
+		m->final_check(e, m_l->m, replace.name,
+		   entries->hook_mask, 1);
+		m_l = m_l->next;
+	}
+	while (w_l) {
+		w = find_watcher(w_l->w->u.name);
+		w->final_check(e, w_l->w, replace.name,
+		   entries->hook_mask, 1);
+		w_l = w_l->next;
+	}
+	t = find_target(e->t->u.name);
+	t->final_check(e, e->t, replace.name,
+	   entries->hook_mask, 1);
+}
+
 int check_inverse(const char option[])
 {
 	if (strcmp(option, "!") == 0) {
@@ -1490,9 +1517,9 @@
 	struct ebt_u_target *t;
 	struct ebt_u_match *m;
 	struct ebt_u_watcher *w;
-	struct ebt_u_match_list *m_l;
+ 	struct ebt_u_match_list *m_l;
 	struct ebt_u_watcher_list *w_l;
-	struct ebt_u_entries *entries;
+ 	struct ebt_u_entries *entries;
 	const char *modprobe = NULL;
 
 	// initialize the table name, OPT_ flags, selected hook and command
@@ -1850,6 +1877,8 @@
 						print_error("Return target"
 						" only for user defined chains");
 				}
+				if (i != NUM_STANDARD_TARGETS)
+					break;
 				if ((i = get_hooknr(optarg)) != -1) {
 						if (i < NF_BR_NUMHOOKS)
 							print_error("don't jump"
@@ -2003,19 +2032,18 @@
 		while (m_l) {
 			m = (struct ebt_u_match *)(m_l->m);
 			m->final_check(new_entry, m->m, replace.name,
-			   entries->hook_mask);
+			   entries->hook_mask, 0);
 			m_l = m_l->next;
 		}
 		while (w_l) {
 			w = (struct ebt_u_watcher *)(w_l->w);
 			w->final_check(new_entry, w->w, replace.name,
-			   entries->hook_mask);
+			   entries->hook_mask, 0);
 			w_l = w_l->next;
 		}
 		t->final_check(new_entry, t->t, replace.name,
-		   entries->hook_mask);
+		   entries->hook_mask, 0);
 	}
-	
 	// so, the extensions can work with the host endian
 	// the kernel does not have to do this ofcourse
 	new_entry->ethproto = htons(new_entry->ethproto);
@@ -2037,6 +2065,29 @@
 	} else if (replace.command == 'A' || replace.command == 'I') {
 		add_rule(rule_nr);
 		check_for_loops();
+		// do the final_check(), for all entries
+		// needed when adding a rule that has a chain target
+		i = -1;
+		while (1) {
+			struct ebt_u_entry *e;
+
+			i++;
+			entries = nr_to_chain(i);
+			if (!entries) {
+				if (i < NF_BR_NUMHOOKS)
+					continue;
+				else
+					break;
+			}
+			e = entries->entries;
+			while (e) {
+				// userspace extensions use host endian
+				e->ethproto = ntohs(e->ethproto);
+				do_final_checks(e, entries);
+				e->ethproto = htons(e->ethproto);
+				e = e->next;
+			}
+		}
 	} else if (replace.command == 'D')
 		delete_rule(rule_nr);
 	// commands -N, -E, -X fall through
@@ -2048,6 +2099,5 @@
 
 	if (counterchanges)
 		deliver_counters(&replace, counterchanges);
-//	list_rules();
 	return 0;
 }
diff --git a/extensions/ebt_arp.c b/extensions/ebt_arp.c
index d094b68..d088563 100644
--- a/extensions/ebt_arp.c
+++ b/extensions/ebt_arp.c
@@ -75,9 +75,8 @@
 #define OPT_PTYPE  0x04
 #define OPT_IP_S   0x08
 #define OPT_IP_D   0x10
-static int parse(int c, char **argv, int argc,
-	        const struct ebt_u_entry *entry, unsigned int *flags,
-	        struct ebt_entry_match **match)
+static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
+   unsigned int *flags, struct ebt_entry_match **match)
 {
 	struct ebt_arp_info *arpinfo = (struct ebt_arp_info *)(*match)->data;
 	int i;
@@ -177,7 +176,8 @@
 }
 
 static void final_check(const struct ebt_u_entry *entry,
-const struct ebt_entry_match *match, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_match *match, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	if (entry->bitmask & EBT_NOPROTO || entry->bitmask & EBT_802_3 ||
 	   (entry->ethproto != ETH_P_ARP && entry->ethproto != ETH_P_RARP))
diff --git a/extensions/ebt_ip.c b/extensions/ebt_ip.c
index cb425f9..71d7f30 100644
--- a/extensions/ebt_ip.c
+++ b/extensions/ebt_ip.c
@@ -218,7 +218,8 @@
 }
 
 static void final_check(const struct ebt_u_entry *entry,
-   const struct ebt_entry_match *match, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_match *match, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	if (entry->bitmask & EBT_NOPROTO || entry->bitmask & EBT_802_3 ||
 	   entry->ethproto != ETH_P_IP)
diff --git a/extensions/ebt_log.c b/extensions/ebt_log.c
index 1dca3ad..b6e62eb 100644
--- a/extensions/ebt_log.c
+++ b/extensions/ebt_log.c
@@ -142,7 +142,8 @@
 }
 
 static void final_check(const struct ebt_u_entry *entry,
-   const struct ebt_entry_watcher *watcher, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_watcher *watcher, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	return;
 }
diff --git a/extensions/ebt_nat.c b/extensions/ebt_nat.c
index fe7cd1a..d94763a 100644
--- a/extensions/ebt_nat.c
+++ b/extensions/ebt_nat.c
@@ -136,22 +136,24 @@
 }
 
 static void final_check_s(const struct ebt_u_entry *entry,
-   const struct ebt_entry_target *target, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_target *target, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	if (!(hook_mask & (1 << NF_BR_POST_ROUTING)) || strcmp(name, "nat"))
 		print_error("Wrong chain for snat");
-	if (to_source_supplied == 0)
+	if (time == 0 && to_source_supplied == 0)
 		print_error("No snat address supplied");
 }
 
 static void final_check_d(const struct ebt_u_entry *entry,
-   const struct ebt_entry_target *target, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_target *target, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	if (((hook_mask & ~((1 << NF_BR_PRE_ROUTING) | (1 << NF_BR_LOCAL_OUT))) ||
 	   strcmp(name, "nat")) &&
 	   ((hook_mask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")))
 		print_error("Wrong chain for dnat");
-	if (to_dest_supplied == 0)
+	if (time == 0 && to_dest_supplied == 0)
 		print_error("No dnat address supplied");
 }
 
diff --git a/extensions/ebt_redirect.c b/extensions/ebt_redirect.c
index 5d329e7..ea0a504 100644
--- a/extensions/ebt_redirect.c
+++ b/extensions/ebt_redirect.c
@@ -59,7 +59,8 @@
 }
 
 static void final_check(const struct ebt_u_entry *entry,
-   const struct ebt_entry_target *target, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_target *target, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 	if ( ((hook_mask & ~(1 << NF_BR_PRE_ROUTING)) || strcmp(name, "nat")) &&
 	   ((hook_mask & ~(1 << NF_BR_BROUTING)) || strcmp(name, "broute")) )
diff --git a/extensions/ebt_standard.c b/extensions/ebt_standard.c
index 726a1ab..95e00a5 100644
--- a/extensions/ebt_standard.c
+++ b/extensions/ebt_standard.c
@@ -26,7 +26,8 @@
 }
 
 static void final_check(const struct ebt_u_entry *entry,
-   const struct ebt_entry_target *target, const char *name, unsigned int hook_mask)
+   const struct ebt_entry_target *target, const char *name,
+   unsigned int hook_mask, unsigned int time)
 {
 }
 
diff --git a/extensions/ebt_vlan.c b/extensions/ebt_vlan.c
index 05ee992..f74b26f 100644
--- a/extensions/ebt_vlan.c
+++ b/extensions/ebt_vlan.c
@@ -193,7 +193,7 @@
 static void
 final_check (const struct ebt_u_entry *entry,
 	     const struct ebt_entry_match *match,
-	     const char *name, unsigned int hook_mask)
+	     const char *name, unsigned int hook_mask, unsigned int time)
 {
 	/*
 	 * Is any proto supplied there? Or specified proto isn't 802.1Q?
diff --git a/include/ebtables_u.h b/include/ebtables_u.h
index 4c4168b..d86a7c7 100644
--- a/include/ebtables_u.h
+++ b/include/ebtables_u.h
@@ -119,7 +119,7 @@
 	        struct ebt_entry_match **match);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_match *match,
-	   const char *name, unsigned int hook_mask);
+	   const char *name, unsigned int hook_mask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_match *match);
 	int (*compare)(const struct ebt_entry_match *m1,
@@ -146,7 +146,7 @@
 	   struct ebt_entry_watcher **watcher);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_watcher *watch, const char *name,
-	   unsigned int hook_mask);
+	   unsigned int hook_mask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_watcher *watcher);
 	int (*compare)(const struct ebt_entry_watcher *w1,
@@ -170,7 +170,7 @@
 	   struct ebt_entry_target **target);
 	void (*final_check)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_target *target, const char *name,
-	   unsigned int hook_mask);
+	   unsigned int hook_mask, unsigned int time);
 	void (*print)(const struct ebt_u_entry *entry,
 	   const struct ebt_entry_target *target);
 	int (*compare)(const struct ebt_entry_target *t1,