I am in the process of trying to migrate from DD-WRT on my primary Router to Tomato. This has been prompted by a need for a more robust QoS system due to the implementation of a new VOIP System. DD-WRT's implementation of QoS is just not satisfactory and after having played with Tomato (Toastman's build to be specific), I have found it to be much better at allocating and controlling traffic in a relatively easy way to manage. What I need to do first is to set up a Tomato based router that provides the same base-level functionality that I have my DD-WRT based router doing currently. I have a custom startup script on my DD-WRT router that provide a number of things; NAT Translation from external IP to internal Quickbooks server, VPN, and a number of other services that servers in an external location need to be able to access. This is my current DD-WRT Startup script (I've changed the some of the IP addresses listed for security purposes): Code: # Add in new IP that the router can listen to ip addr add <Second External IP Address> dev vlan1 ip addr add <Third External IP Address> dev vlan1 # Allow loopback for the new IPs (from internal to external) iptables -t nat -I POSTROUTING 1 -p all -s 10.x.x.32 -j SNAT --to <Second External IP Address> iptables -t nat -I POSTROUTING 1 -p all -s 10.x.x.45 -j SNAT --to <Third External IP Address> # QuickBooks: 80 (HTTP), 443 (SSL), 3306 (MySQL), 3389 (RDP) iptables -t nat -A PREROUTING -p tcp -d <Second External IP Address> --match multiport --dports 80,443,3306,3389 -j DNAT --to-destination 10.x.x.44 iptables -I FORWARD -p tcp -d 10.x.x.44 --match multiport --dports 80,443,3306,3389 -j ACCEPT # VPN iptables -t nat -A PREROUTING -p tcp -d <Third External IP Address> --dport 1723 -j DNAT --to-destination 10.x.x.45:1723 iptables -I FORWARD -p tcp -d 10.x.x.45 --dport 1723 -j ACCEPT # Development Website iptables -t nat -A PREROUTING -p tcp -d <Primary External IP Address> --dport 80 -j DNAT --to-destination 10.x.x.41:80 iptables -I FORWARD -p tcp -d 10.x.x.41 --dport 80 -j ACCEPT # External to internal LDAP Translation iptables -t nat -A PREROUTING -p tcp -d <Third External IP Address> --dport 389 -j DNAT --to-destination 10.x.x.45:389 iptables -I FORWARD -p tcp -d 10.x.x.45 --dport 389 -j ACCEPT If I copy and paste this exact script to my Tomato based router (in the firewall script), it doesn't work; VPN won't connect, LDAP fails, etc. I just can't seem to figure out why. In looking at the output from "iptables -vnL" and "iptables -t nat -L --line-numbers" on both routers, it appears that there are some differences when it seems like they should be the same, if they're using the same custom startup script. Specifically, there are some DROP rules in the beginning of the INPUT, FORWARD, and PREROUTING chain on Tomato that are not showing up on DD-DWRT. I added a few rules to remove those on Startup but it's still not working. I suspect that the way my rules are setup on DD-DWRT are simply not correct for Tomato and it's implementation of iptables. If anyone can provide some insight, I would really appreciate it. I've got to get this functionality working before I can even begin playing with QoS. Thank you in advance for any input. If I need to provide more information, please let me know.