Aleksandar Milivojevic wrote: > Unless you are doing something funky, SNAT is not needed. All he needs > is DNAT. Hmmm, I may be unclear on this. When doing DNAT, is the source IP address of the traffic coming from firewall and going to the internal host set to the internal address of the firewall? Or does it remain the address of the outside host that initiated the traffic in the first place. I always *assumed* (a bad thing) that it was the latter. Thus my statement regarding the need for SNAT on the outbound traffic. Kirk