The IP tables are quite long as we have quite a few VPN rules.
Ok. I understand and will take that in to advisement.
The rest is quite straight forward.
What would be easiest to start with.
Well if you are not doing any thing weird as far as filtering in your nat or mangle tables then I'd like to see an output of your filter tables FORWARD chain. If you want to scrub IPs for security reasons I understand perfectly. Can I also see an output of "ip route list table main"? Can I get a list of what devices / aliases and their IPs are (or scrubbed for conversation)? That way what I send back to you could be close to production information.
PS its night time here in the UK ......
*nod* I'm presently at -5 UTC (day light savings time, we are really -6).
Grant. . . .
