Hi curtain,

i thought that the firewall _really_ masquerades my lan; but when i watched myself being online from a friend's box running licq 1.1.0, licq told me - apart from the external ip beginning with 62. - my private ip :(

Well, your icq client tells your private IP. no wonder. The point is, your firewall _is_ masquerading your lan. Else you'd never get an answer from the internet... Masquerading works basically as follows: Each request from the internal net is translated to your masquerading server's external ip address. Answers to those requests are remapped back to your private ip address by the masq server. Masquerading has the following useful features: a) You are enabled to connect several machines to the internet without the need to have several public ip addresses b) Machines from the internet can not connect to any of your internal machines (except you tell your masq server to forward certain requests). This implies, even if icq tells your internal ip addresses, a casual attacker can not attack your internal machines (unless he has cracked your masq server, of course. To stop icp delivering your int ip address you'd need an application layer proxy for icq. Dunno if one exists... Same applies for other applications. Robert

if licq is capable in looking behind that firewall, how can i assure that _real_ hack programs cannot do this ... i suggest that icq delivers all ips that it can gather; but don't other apps also??? how can i tell the firewall not to submit internal ip names - well - is the fw able to do it?