Re: should ip_natout return -1 when it run out of port to create nat

No it hasn't.

But you can write a rule, like this:

block out on ppp0 all with not nat

To block any packets going out on ppp0 that aren't nat'd.

Of course this won't affect packets that match "keep state" rules.

Hmm.

Darren