diff --git a/docs/FAQ.xml b/docs/FAQ.xml
index 0d1f8c905..88809ead7 100644
--- a/docs/FAQ.xml
+++ b/docs/FAQ.xml
@@ -17,7 +17,7 @@
- 2006-03-14
+ 2006-05-18
2001-2006
@@ -238,6 +238,17 @@ DNAT net loc:<local IP address>[:<
+
+
+ If the packet count is non-zero, check your log to see if
+ the connection is being dropped or rejected. If it is, then you
+ may have a zone definition problem such that the server is in a
+ different zone than what is specified in the DEST column. At a
+ root promt, type "shorewall show zones" then be
+ sure that you have specified in the DEST column the first zone in
+ the list that matches the OUT=<dev> and the DEST=
+ <ip>from the REJECT/DROP log message.
+