...

Firewall is based on IPChains firewall from Ziegler's book "Linux Firewalls" 1st ed, which denies all then allows as needed. I've triple-checked the firewall -- the only non-comment changes made were all added ACCEPT statements, all cut&pasted from the Home firewall. There are no IP-specific denies that I added to the firewall - and I haven't updated rc.firewall.blocked in months.

Sounds like you're further up on Linux firewalling than I am, actually. For myself, I run a modified Linux Router Project disk image, and let NAT and Portsentry take care of most of my issues. If you say it's clean, then it must be clean. Understand though, the techs will NEVER believe this. At ALL. If you made changes to a firewall and then you couldn't access, it's Somebody Else's Problem, and that's their professional opinion. (I should know, I was one. :) )

Well, the problem was in the firewall, but it doesn't explain EVERYTHING that happened. After two hours on the phone Mon afternoon with Qwest tech support level 2, they insisted I try ping/traceroute with the firewall disabled. Pings moved through as expected ...hmmmm I'd been through the firewall code so many times I just about had it memorized, so I decided to look at the file rc.firewall.blocked which it reads, which has of a list of IPChains statements blocking IP#s (which the main firewall doesn't do). I hadn't really updated this much recently, because when someone started banging on the firewall, it was tough to know if it was a static IP or not. Anyways ... found TWO entries that were <Home IP#>/24 and <Home network>/24 ... basically the same thing. Don't remember putting THOSE in there <g> When I rebuilt the last hacked machine (EFO) I copied rc.firewall and rc.firewall.blocked from the home machine, because I couldn't read the copies I'd backed up from EFO.... so the block against the Home IP was at both ends of the link. The only mystery is why everything worked for two hours Friday night before I reloaded the EFO firewall -- because the rc.firewall.blocked file hadn't been changed in more than a week, and had already been loaded with the firewall when I first brought up the EFO server on Friday. Now if I could get any takers on finding out why none of my servers can send email to each other (but only each other) since they were upgrade from RH7.0 to RH7.3 (sendmail 8.11.6) I'll be all set. [Email to list 10/31] Dick