sorry for the html format,now i post it again. i had read many documents but i didn't find answer. i have a network as following: A------------------B====================C 192.168.110.x 192.168.110.y 202.101.k.m 202.101.k.n the B is a gateway doing NAT. it's eth0 is 192.168.110.y and eth1 is 202.101.k.m. there is RH9 running on it,it's kernel is 2.4.21. i have pathched the h323,and runned up the modules ip_conntrack_h323 and ip_nat_h323. the A and the C are netmeeting clients. i test it with 2 methods: 1)both A and C logon to a ILS. RESULTS: A calls C is ok, and they can chat to each other. C calls A is failure, i see the address called is the private address of A. so setting up is failure. QUESTION: doesn't the patch do something when client logon to a ILS? 2)call each other without the ILS. i add a rule: iptables -t nat -A PREROUTING -i eth1 -p tcp -m multiport --dports 1503,1720 -j DNAT --to-destination 192.168.110.x they call each other with IP address. A calls C with C's IP as the destination, and C calls A with gateway's valid IP as the destination. RESULTS: A calls C is ok, and they can chat to each other. C calls A is ok, but they can't chat to each other. QUESTION: is the rule right? h.323 streaming port is dynamic, does it result this symptom? even though i add the rule right,i think it's no use.it just enable one client to go through the gateway.is it? any help is appreciated.