Bharath Ramesh píše v Pá 13. 06. 2008 v 21:29 +0200: > $IPT --append INPUT --in-interface $EXTIF --protocol icmp --icmp-type 0 \ > --destination $EXTIP --match state --state NEW,ESTABLISHED,RELATED \ > --jump ACCEPT A side note: I wonder how much use is "--match state" in ICMP context. (Well, I can't see any icmp entries in /proc/net/ip_conntrack anyway). You might want to consult debian-firewall list. Vit