The access restriction in tomato (or victek's which I am using now) is very limited. I can specify the order of rules which limit multilevel rules. It also cannot specify "not" statement. Here is what I am trying to do. Certain users are not allowed to access the internet. But I do want them to access sites like windows update site in order for them to update their windows regularly. Or perhaps antivirus update site. But I can't figure out how to do this. Anyone have any idea??? Other than this problem, tomato seems to be a very good and light firmware.