> so,only 4 lookup for non firewalled interfaces. it is too late for me now - will try to understand that tomorrow ;-) But I think it would be great to extend the test simulator to simulate more exactly, so that we count the number of checks needed ..