Hi there Justa quick one - I use $DMZPORTS to define the ports I wish to be allowed inbound on the forward chain - can I use ! -m multiport --dports $DMZPORTS to mean "any port that isn't specified by $DMZPORTS"? Thanks and mince pies to all! Steve ----------------------------------------------------------------------- Information in this email may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. -----------------------------------------------------------------------