[ale] port forwarding for iptables.

[Atlanta Geek]

OK. so I am trying to use portforwarding with iptables

here is the output from  'lsmod | grep iptable' , iptables-save and
iptables --list

any suggestions would be great
The only thing that is a little weird with this is that I am
forwarding ports within the same network.  So maybe the -DNAT is
screwing things up?

*************OUTPUT of lsmod
[root at krobinson sysconfig]# lsmod | grep iptable
iptable_filter         36161  1
iptable_nat            40773  1
ip_nat                 53100  1 iptable_nat
ip_conntrack           91236  5
ip_conntrack_ftp,ip_conntrack_netbios_ns,xt_state,iptable_nat,ip_nat
ip_tables              55329  2 iptable_filter,iptable_nat
x_tables               50377  8
ipt_LOG,xt_state,iptable_nat,ip_tables,ip6_tables,ipt_REJECT,ip6t_REJECT,xt_tcpudp

**********OUTPUT  of 'iptables-save' START
nat
:PREROUTING ACCEPT [55:9852]
:POSTROUTING ACCEPT [74:4440]
:OUTPUT ACCEPT [74:4440]
-A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j DNAT
--to-destination 10.0.1.213:3001
-A PREROUTING -d 10.0.0.39 -i eth0 -p tcp -m tcp --dport 5213 -j  LOG
--log-prefix "TCP PREROUTING:"

COMMIT
# Completed on Wed Jun 10 00:11:38 2009
# Generated by iptables-save v1.3.5 on Wed Jun 10 00:11:38 2009
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [3459:642904]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j ACCEPT
-A FORWARD -d 10.0.1.213 -i eth0 -p tcp -m tcp --dport 3001 -j LOG
--log-prefix "TCP FORWARD:"
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 3001 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5000 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Jun 10 00:11:38 2009
***************OUTPUT END
But it does not seem to be working.  The output from my iptables -l
looks like the following

*********OUTPUT 'iptables --list'  START
[root at krobinson sysconfig]# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             lab-at2503          tcp
dpt:redwood-broker
LOG        tcp  --  anywhere             lab-at2503          tcp
dpt:redwood-broker LOG level warning prefix `TCP FORWARD:'

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere
ACCEPT     ah   --  anywhere             anywhere
ACCEPT     udp  --  anywhere             224.0.0.251         udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:redwood-broker
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:commplex-main
ACCEPT     tcp  --  anywhere             anywhere            state NEW
tcp dpt:http
REJECT     all  --  anywhere             anywhere
reject-with icmp-host-prohibited
**********OUTPUT END
-- 
http://www.atlantageek.com