When I ping from a public IP it works, the traffic will then be routed over internet to amprgw and then tunneled to him. He probably has reverse traffic via amprgw so there is an open "session" in his router. When he pings me, he gets replies. But when I later (or before) ping him, I only see the traffic departing at our GW (properly encapsulated and sent to 181.192.58.28) but nothing is returned. I suspect it is the problem of being behind a stateful firewall in a NAT router. This sometimes cannot be disabled for other protocols than TCP/UDP even when defining the host as "DMZ Host". But I don't know if he has already tried that. Rob