Ah is that the reason? The netmask on tunl0 is 255.255.255.255. I have only a single address on my tunnel endpoint. Is that not allowed? What should it be instead? In the meantime I have solved it by using ampr-ripd instead of rip44d. It has the -r option to use a raw socket to receive everything on tunl0 and picking out the RIP datagrams itself. That works OK. I have a Rasperry Pi that is located in a datacenter. It is directly on Internet. Now I am running the net-44 tunnel stuff on it, it acts as my gateway for two single addresses and a subnet. There is a local copy of NETCHL running there as well, on 44.137.40.1. I can access the different amprnet systems from there. It is running under "screen" so I can take over the console from where I like. My subnet is routed to my home system via an IPsec tunnel, where I still run some services that I want to move there. The default route for net-44 traffic at home is now to my Pi. It runs beautifully. Now my system at home is a lot less complicated, and I can more easily upgrade to a newer Linux version without disturbing all the special networking stuff. Rob