2 problems that seem to be related.

I run a DNS server internally that is a secondary for a few domains.
I successfully implemented a NAT rule from the outside and I am able to serve DNS queries on port 53.
For some reason I periodically see UDP SRC port 53 being blocked from my primary server even though I allow ALL traffic from ithe primary host. (IPMASQ is on a different chain?)

I have a similar problem with an IPSEC vpn client that sits inside my network.

I do not use ANY of the asl VPN components in ASL. Periodically I see ASL blocking UDP port=500 in a burst of 6 or so packets... Then my connection drops. I reconnect and then I am good to go. Perhaps the problem is on the other end I don't know.

It seems as this is an IPMASQ issue.

Do you use "Log Allow"? Which version are you using?

Xeno