It's not my LAN that can't see something. It's the LANs connected to me that can't see the BSD machine at the private address. I'm connected to these other LANs via older Cisco routers talking over T1s. Our ISP's Cisco guy said that the problem was probably the default gateway for the BSD machine at the private address. In rc.conf, sure enough, I don't have a default gateway for the machine's "inside-the-firewall" NIC. I only have a default gateway for the "outside-the-firewall" NIC. How do I set two default gateways, one for each address class I'm using?