hi! Now it works! ;-) THANX!! I did it this way: I flushed the old rules and reloaded everthing (checked that the deny-rule is over the allow-rules). This rule did it: ipchains -I input 1 -p tcp -s 0/0 -d domain-ip -j DENY ..and as soon as I have time I'll read the Howto's,manpages and RFC's.. ;-) (In the end one of the last biggest problems in technology is that your lifetime is limited...) bye & thanx again...