Just a note that I got an offlist suggestion about loading ip_conntrack_ftp - I'd already done that, not the problem. Whit