One other thing, is your apache server on the same machine? I have had issue with blocking access before because of conflicting rules. I had a forwarder set up to direct traffic to my web server in the DMZ, set up a block on the firewall and found that the traffic was still being forwarded. I then had to alter my forwarding rule to forward only from designated ranges, so that my blocks would have effect. what do your log files say about the accepted sessions? -- You own a dog, but you can only feed a cat.