m wrote: > > Why proxy_arp? > > because SNAT DNAT not work properly with - for example H.323 (even if > module for this is in kernel) and others... > > is any other secure method ? I am not really sure what you want to do exactly. Maybe draw a little ascii-art with IP-addresses and everything to show what you want. IMHO proxy ARP is ugly. Maybe you can bridge instead?