Hi! Main firewall PREROUTING chain: ACCEPT all -- 192.168.16.x1 0.0.0.0/0 ACCEPT all -- 192.168.16.x2 0.0.0.0/0 ... DNAT tcp -- 0.0.0.0/0 x.y.z.v multiport dports 80,22,443 to:192.168.32.x REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 80 Internet enabled 192.168.16.x1 (...x2), other IPs disabled and to answer redirected main http-server (main homepage). If pub.ips send http to x.y.z.v then return 192.168.32.x http-server => OK. If 192.168.16.x1 (...x2) priv.ips send http to x.y.z.v then answer main redirected http-server. WHILE? Top accept all packages from 192.168.16.x1 (...x2). WHILE? by gabor ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.