Hello, There is a figure Oskar Andreassoons IPTABLES TUTORIAL (V1.1.19, chap. 3.1, pg.19) where both, the forwarded and the local output, join the postrouting chain. Why shoudnt it be possible to filter all outgoing e.g. smb traffic from a local network at that place with a command like >iptables -t nat -A POSTROUTING -o ppp0 -p tcp --dport 137:139 -j DROP >iptables -t nat -A POSTROUTING -o ppp0 -p udp --dport 137:139 -j DROP The same question applies to the PREROUTING chain for input >iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 137:139 -j DROP >iptables -t nat -A PREROUTING -i ppp0 -p udp --dport 137:139 -j DROP Thanks Claus
