While [iptables-extensions.man](https://ipset.netfilter.org/iptables-extensions.man.html#lbBP) says `socket-exists` should be used the same as `uid-owner` or `uid-owner`, ferm requires and inserts `cmd-owner` before. ``` chain OUTPUT mod owner socket-exists <-- Unrecognized keyword: socket-exists ```
While iptables-extensions.man says
socket-existsshould be used the same asuid-owneroruid-owner, ferm requires and insertscmd-ownerbefore.