OK, maybe I've been going about this the wrong way. I've been testing connectivity to my internal server through the external interface AT the internal server, i.e. from the IIS server computer (SecureNAT client) trying to telnet to the opened ports on the external interface. I just tried it from another computer on the network that is a firewall client. It works! But another computer (not the server) that is a SecureNAT client still cannot access the external interface. So, the questions now is: why can I access via the firewall client, but not as a SecureNAT client? Daniel