> > Another test: what happens if you omit "return .*" lines from ACL-s? > If I omit "return .*" (which is equivalent deny .* as I understand) I can No, it is not. "return" means: "do not decide now but continue search in the config tree". Gabor