> That doesn't achieve what I want. If a TCP connection is rejected at > the firewall, then blocking ICMP at the upstream router will block the > host-unreachable from going out, not make it seem as if the router is > the source. You want to do SNAT?
