http://www.heise-security.co.uk/articles/print/82481 I received that from the iptables mailing list. I think it won't work if you explicitly deny outbound traffic. Dan