Thanks, Florin and Robert, for your suggestions. I'm still stumped, though. This rule looks to be the REDIRECT rule that Robert suggests. Unfortunately, as I have it written here, it fail instantly -- telnetting to port 80 causes an instant error. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to- ports 127.0.0.1:8080 This gets packets in, but no reply: iptables -t nat -A PREROUTING -p tcp -d 64.61.61.112 --dport 80 -j DNAT --to-destination 127.0.0.1:8080 Florin, I did try running tcpdump before -- good to hear this was a sound way to debug this; the above "no reply" rule shows the following packet: 19:47:07.707346 IP [my laptop's ip address].39679 > 64.61.61.112.http: S 4212369272:4212369272(0) win 5840 <mss 1460,sackOK,timestamp 1264677320 0,nop,wscale 2> So, I'm still stumped. The exact iptables rules are below. Any other thoughts? There's not something besides /proc/sys/net/ipv4/ ip_forward that needs to be twiddled, is there? best, Jeff > % iptables -L -v > Chain INPUT (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > 197 20881 RH-Firewall-1-INPUT all -- any any > anywhere anywhere > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > 0 0 RH-Firewall-1-INPUT all -- any any > anywhere anywhere > > Chain OUTPUT (policy ACCEPT 139 packets, 36106 bytes) > pkts bytes target prot opt in out source > destination > > Chain RH-Firewall-1-INPUT (2 references) > pkts bytes target prot opt in out source > destination > 8 1688 ACCEPT all -- lo any anywhere > anywhere > 1 84 ACCEPT icmp -- any any anywhere > anywhere icmp any > 0 0 ACCEPT ipv6-crypt-- any any > anywhere anywhere > 0 0 ACCEPT ipv6-auth-- any any > anywhere anywhere > 0 0 ACCEPT udp -- any any anywhere > 224.0.0.251 udp dpt:5353 > 0 0 ACCEPT udp -- any any anywhere > anywhere udp dpt:ipp > 181 18689 ACCEPT all -- any any anywhere > anywhere state RELATED,ESTABLISHED > 2 120 ACCEPT tcp -- any any anywhere > anywhere state NEW tcp dpt:ssh > 0 0 ACCEPT tcp -- any any anywhere > anywhere state NEW tcp dpt:http > 0 0 ACCEPT tcp -- any any anywhere > anywhere state NEW tcp dpt:webcache > 5 300 ACCEPT tcp -- eth1 any anywhere > anywhere tcp dpt:5666 > 0 0 REJECT all -- any any anywhere > anywhere reject-with icmp-host-prohibited -- Jeff Potter http://www.atof.net/go/boston