At the moment I run my firewall script from /etc/dhclient-enter-hooks, just before the interface is brought up. So at bootup it will indirectly be activated by the networking script. The problem is that this means I can't use domain names in the fw script - the local bind is run later. Has anyone found an elegant solution? Thanks Christian