This change rolls up the fix for the long-standing ProxyARP/IPSEC incompatibility. The fix has been available for some time on the 1.4 Errata page. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net