mmelby,
The firewall has 2 IP interfaces, there are two rules allowing traffic to and from machines inside with full logging and no protocol restrictions (for testing) from inside you can ping the internal interface of the firewall and the external interface but no further. ICMP is allowed in the policy properties so that is not an issue. from outside you can ping both interfaces of the firewall but no further through. if i enable NAT for one machine object and allow it to use the firewall gateway IP address this works fine from inside so i think i am missing a routing rule somewhere. the FW1 software is running on Checkpoint Secure Server (FP2)

Paul