IPTables / Fedora Core 3 port forwarding

My inbound port forwarding firewall rules no longer work after
upgrading to Fedora Core 3. Networking is working (DNS, Sendmail,
IMAP/POP, etc). IPTables is partially working: Masquerading is OK - it
is only inbound rules that don't work at all.

Here are relevant lines from my script:

###################
iptables -t filter -A FORWARD -i eth0 -m state --state
ESTABLISHED,RELATED -j \
ACCEPT
iptables -t filter -A FORWARD -i ! eth0 -m state --state NEW -j ACCEPT

# Allow connections from Inside --This works fine
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE


#Inbound VNC -- does not work !!??
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5900 -j DNAT \
--to-dest 192.168.0.5

####################

What gives ?

(E-Mail Removed) wrote:
> My inbound port forwarding firewall rules no longer work after
> upgrading to Fedora Core 3. Networking is working (DNS, Sendmail,
> IMAP/POP, etc). IPTables is partially working: Masquerading is OK - it
> is only inbound rules that don't work at all.
>
> Here are relevant lines from my script:
>
> ###################
> iptables -t filter -A FORWARD -i eth0 -m state --state
> ESTABLISHED,RELATED -j \
> ACCEPT
> iptables -t filter -A FORWARD -i ! eth0 -m state --state NEW -j ACCEPT
>
> # Allow connections from Inside --This works fine
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
>
>
> #Inbound VNC -- does not work !!??
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5900 -j DNAT \
> --to-dest 192.168.0.5
>
> ####################
>
> What gives ?
>
Recompile IPTables manually with all modules. Check linux netfilter
kernel modules, if installation of FC3 change kernel.

On Wed, 25 May 2005 22:37:18 -0700, lars wrote:

> My inbound port forwarding firewall rules no longer work after
> upgrading to Fedora Core 3. Networking is working (DNS, Sendmail,
> IMAP/POP, etc). IPTables is partially working: Masquerading is OK - it
> is only inbound rules that don't work at all.
>
> Here are relevant lines from my script:
>
> ###################
> iptables -t filter -A FORWARD -i eth0 -m state --state
> ESTABLISHED,RELATED -j \
> ACCEPT
> iptables -t filter -A FORWARD -i ! eth0 -m state --state NEW -j ACCEPT

Is there any reason you only want to forward NEW packets and not
ESTABLISHED and RELATED as well?

Is there any reason why you are accepting EVERYTHING on EVERY PORT? Just
accept port 5900.

iptables -t filter -A FORWARD -i [external interface] \
-p tcp --dport 5900 -j ACCEPT # Accept all states but only TCP port 5900
on the internet.

> # Allow connections from Inside --This works fine
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
>
>
> #Inbound VNC -- does not work !!??
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5900 -j DNAT \
> --to-dest 192.168.0.5
>
> ####################
>
> What gives ?