> I suppose > startup scripts could install a block all, bring up networks, and then > install the real ruleset. fwiw it's similar to what openbsd does. YAMAMOTO Takashi