Port forwarding error

[Metal Gear <finattack@gmail.com>]

Hi, 

First of all thanks for quick reply.
After reading the reply throughly i completed my rulesets and sending
it for ur review. I m need little explanation regarding rules u sent
to me
[Quote]
You can do it this way. Remember, that only NEW packages (with SYN
set) will hit this rule. Next step is to allow these connection in
FORWARD chain (assuming the policy id DROP or REJECT).
[/Quote] and

[Quote]
And don't forget to allow ICMP "Destination Unreachable" :)
[/Quote]

Why is this sooo??? Why we need the above two rules.

And for the rules for pop, smtp and dns forwarding what i understood
from the diagram (tables_traverse.jpg) of
(http://iptables-tutorial.frozentux.net/)
- We got a packet from network
- We done NAT PREROUTING
- We FORWARDED the packet
- We done NAT POSTROUTING
- The packet agains flow the interface
Am i right???????

Below is my final rules script based on your help

Thanks
-----------------------------------------------------------------------------------
#!/bin/sh

# Flushing the chains
iptables -F
iptables -F -t nat

# Allow icmp destination unreacable
iptables -A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT

# Rules for Squid
iptables -A INPUT -p tcp -s $LAN_ADDRESS/$NETMASK --dport 3128 -m
state --state NEW,ESTABLISHED,RELATED -j accept
iptables -A OUTPUT -p tcp -d $LAN_ADDRESS/$NETMASK --sport 3128 -m
state --state ESTABLISHED,RELATED -j accept

# Enabling POP3 Forwarding
iptables -A PREROUTING -t nat -d squidip -p tcp --dport 110 -j DNAT
--to $POPSERVER
iptables -A FORWARD -p tcp --dport 110 -d $POPSERVER -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --sport 110 -s $POPSERVER -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp --dport 110 -d $POPSERVER -j
SNAT --to $SQUIDIP

# Enabling SMTP Forwarding
iptables -A PREROUTING -t nat -d squidip -p tcp --dport 25 -j DNAT
--to $SMTPSERVER
iptables -A FORWARD -p tcp --dport 25 -d $SMTPSERVER -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp --sport 25 -s $SMTPSERVER -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp --dport 25 -d $SMTPSERVER -j
SNAT --to $SQUIDIP

# Enabling DNS Forwarding
iptables -A PREROUTING -t nat -d squidip -p udp --dport 53 -j DNAT
--to $DNSSERVER
iptables -A FORWARD -p udp --dport 53 -d $DNSSERVER -m state --state
NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p udp --sport 53 -s $DNSSERVER -m state --state
ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p udp --dport 53 -d $DNSSERVER -j SNAT
--to $SQUIDIP