A method performed in an intermediary network node comprising: defining at least one connection between protocol entities hosted by network nodes in a packet data communication network; receiving data packets including information identifying communicating protocol entities; receiving the data packets at the intermediary network node from a source network node; maintaining data packet processing batches (206, 208) comprising a first set of data packet processing batches corresponding to defined connections and a second set of data packet processing batches without a corresponding defined connection; storing the received data packets into a data packet processing batch in the first set of data packet processing batches corresponding to the defined connections on the basis of the information identifying communicating protocol entities; and storing the received data packets into a data packet processing batch in the second set of data packet processing batches, the second set of data packet processing batches corresponding to data packets without the defined connections; characterized in that the method further comprises: processing at least one data packet processing batch in the second set of data packet processing batches without the defined connections, said processing comprising firewall operations performed once, batch-wise for the whole batch according to individual rules determined by information derived from a specific packet of the batch identifying communicating protocol entities, wherein the firewall operations include firewall access control enforcement or allowing or rejecting TCP connections on the basis of a rulebase; and transmitting the data packets to a destination network node, wherein said source and destination network nodes communicate on an end-to-end-connection between a source protocol entity and a destination protocol entity. defining at least one connection between protocol entities hosted by network nodes in a packet data communication network; receiving data packets including information identifying communicating protocol entities; receiving the data packets at the intermediary network node from a source network node; maintaining data packet processing batches (206, 208) comprising a first set of data packet processing batches corresponding to defined connections and a second set of data packet processing batches without a corresponding defined connection; storing the received data packets into a data packet processing batch in the first set of data packet processing batches corresponding to the defined connections on the basis of the information identifying communicating protocol entities; and storing the received data packets into a data packet processing batch in the second set of data packet processing batches, the second set of data packet processing batches corresponding to data packets without the defined connections; characterized in that the method further comprises: processing at least one data packet processing batch in the second set of data packet processing batches without the defined connections, said processing comprising firewall operations performed once, batch-wise for the whole batch according to individual rules determined by information derived from a specific packet of the batch identifying communicating protocol entities, wherein the firewall operations include firewall access control enforcement or allowing or rejecting TCP connections on the basis of a rulebase; and transmitting the data packets to a destination network node, wherein said source and destination network nodes communicate on an end-to-end-connection between a source protocol entity and a destination protocol entity. processing at least one data packet processing batch in the second set of data packet processing batches without the defined connections, said processing comprising firewall operations performed once, batch-wise for the whole batch according to individual rules determined by information derived from a specific packet of the batch identifying communicating protocol entities, wherein the firewall operations include firewall access control enforcement or allowing or rejecting TCP connections on the basis of a rulebase; and transmitting the data packets to a destination network node, wherein said source and destination network nodes communicate on an end-to-end-connection between a source protocol entity and a destination protocol entity.