Ubuntu server 18.04: suricata rule blocks dwservice, but not teamviewer or anydesk

I wouldn’t say useless but you need to ensure that the traffic you want to be inspected by Suricata is passed to Suricata. So in generall the recommendation is to use the -j NFQUEUE for all chains or at least for forward if you run it on a gateway.