Why/How would the linux box broadcast it's ARP response to 10.0.0.1 when the IP doesn't belong to the firewall.. it just has a rule saying what to do if the packet arrives to it asking it to forward to that host... ARP is on different IP layer to netfilter. The rule doesn't make it respond to arp requests. Thanks, ____________________________________________ George Vieira Systems Manager georgev@xxxxxxxxxxxxxxxxxxxxxx Citadel Computer Systems Pty Ltd http://www.citadelcomputer.com.au Phone : +61 2 9955 2644 HelpDesk: +61 2 9955 2698 -----Original Message----- From: Shawn [mailto:core@xxxxxxxxxx] Sent: Friday, June 20, 2003 12:29 PM To: George Vieira Cc: netfilter@xxxxxxxxxxxxxxxxxxx Subject: RE: Is this correct? I get confused because I picture other 10.0.0.0/24 hosts arping for 10.0.0.1 and getting the MAC for linux-router/eth0. How is this not the case? Thank you all so much for the help!