...I am using FW_FORWARD_MASQ Is this a valid record 0/0,10.0.0.3,tcp,80 I want to allow all ips to access an internal server web server not on a DMZ Or should I use 66.x.x.x,10.0.0.3,tcp,80 to do this where 66.x.x.x is the ext ip of my firewall. Mike