>need to assign rules in the lan in order to see the VLAN subnet. Well, the lan has a rule matching packets in on LAN interface to *. I assume I can't get broader than that? Is there still something else that is specific for a vlan? The "*" destination should match packets headed to the opt1 interface?
Thanks! jlc
