The 1.2.7 release of iptables has made an incompatible change in the syntax used to specify multiport matches. As a consequence, users upgrading to iptables 1.2.7 must set MULTIPORT=No in /etc/shorewall/shorewall.conf. I''ll have an updated firewall script available in the next day or two. -Tom -- Tom Eastep \ Shorewall - iptables made easy AIM: tmeastep \ http://www.shorewall.net ICQ: #60745924 \ teastep@shorewall.net