Crap, I had a typo. It should have been -i, not -o for the lan interface $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT Try that and let us know. Gary Wayne Smith -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Greg Cope Sent: Tuesday, January 25, 2005 9:59 AM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: Help debugging iptables firewall.... I think we are getting there: The one you suggested gives an error: Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed Looking at tcpdump on a few machines it looks like the packets are getting through - but nothing gets sent: 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024 0,nop,wscale 0> (DF) [tos 0x10] And then nothing else - sadly I am not a tcpdump expert..... Any clues? I am at a loss as to why this was working and now it does not..... Greg
