It''s becoming clear that there will be a restriction on what should be added to dynamic zones. In particular, you don''t want to add something to a dynamic zone that is a super-set of an existing zone. Other than that, I think the new code is working rather well with the latest CVS version. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net