[jrdld]

Thanks Lackie, but there's a problem with this, if I understand correctly how SecureClient work. When they're disconnected from the VPN, the "allusers@any" rules come into force, so the policy can't distinguish between the users that I want to have a firewall and those that I don't.

JR