I did this once more than 10 years ago. If I was to do it again, I would probably get shorewall to do most of the heavy lifting: --------------------------------------------- Hey, thanks everyone for your help... I thought this would be easy with iptables, but looks like I have some fun experimental work ahead of me :)