Does Untangle have the ability to do a TCP dump? I could enable that in the inside interface and then the outside interface on UT, compare the two and see what you come up with. It may be worthwhile to do this on the external side of pf as well. If UT's bridge mode is truly bridge, then you should have no issues.
Curtis LaMasters http://www.curtis-lamasters.com http://www.builtnetworks.com
