DNAT to a virtual IP problems

[Stephen Mathezer <mathezer@yahoo.com>]

I am having some trouble with DNAT. For various reasons I am running a
webserver that is listening on virtual IP addresses on the internal
interface of my firewall.  I am trying to forward ports 80 and 443 from
the external interface to various virtual internals.  No matter what I
do, packets never seem to show up on the virtual interfaces.

Relevant facts:

Kernel 2.4.17, iptables 1.2.6a (I could upgrade if I knew it would fix
                                my problems)
Cable internet connection (ie: DHCP) on the external interface
eth0 is external
eth1 is internal (192.168.8.1/24)

I have tried using an address on the same subnet (192.168.8.22) as well
as addresses on other subnets (192.168.3.22) for interfaces eth1:0,
eth1:1 etc.  NAT'ing to another box on the internal LAN works fine, it
is just NAT to the virtual that is broken.

I am doing the DNAT as follows:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to
192.168.8.22:443

Tcpdump on eth0 shows traffic arriving, iptables doesn't log anything
interesting, although I guess I don't have any logging configured in the
nat table.  Tcpdump on eth1:0 never sees any packets arriving.

I am permitting port 443 connections inbound on eth0. An identical
configuration, except NAT'ing to another webserver on the LAN works
fine, it is just NAT'ing to a virtual that doesn't work.

I have also tried doing the source NAT just in case, although since
traffic never gets to eth1:0 it shouldn't matter at this point:

iptables -t nat -A POSTROUTING -d 192.168.8.22 --dport 443 -j SNAT --from 192.168.8.1

Should this work? Is there something else that I need to be doing?

thanks for any tips

-Steve