Stephen Satchell <list@xxxxxxxxxxxx> wrote: > firewall box is compromised. Earlier comments indicated that "fib saddr > type <x>" and "fib saddr oif <x> are not allowed in the FILTER/OUTPUT and > FILTER/POSTROUTING chains. saddr isn't a problem. 'saddr . iif' is (there is no 'input interface').