How about: ipchains -A input -d $ETH0_NET -s $ALL ! -y -j ACCEPT This allows packets for already established sessions. Your LAN users will be able to establish outgoing connections still, but this rule will not match packets with SYN set. Alexander Else Internet Operations Technician OzEmail / UUNET Asia Pacific Operations -- SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au To unsubscribe send email to [EMAIL PROTECTED] with unsubscribe in the text
