Port Forwarding for port 25 (again...)

[Magnus Solvang <magnus@solvang.net>]

I have a firewall set up with an internal (192.168.1.20) and
an external ip-address (x.x.x.49). The former mailserver for
this domain has been placed on the LAN, and given the address
192.168.1.101. MX for the domain still points to its old
ip-address (x.x.x.34). The firewall is behind the router for
the external domain.

I'm can't seem to be able to forward smtp-traffic from x.x.x.34
to 192.168.1.101 via the firewall. I _am_ able to forward port
25 from the firewalls external interface to the mailserver behind,
but as mentioned - not from the former ip-address of the mailserver,
and to the new internal address.

I have tried numerous versions of:
$IPTABLES -t nat -A PREROUTING -i $INET_NCARD -d x.x.x.34 -p tcp \
--dport 25 -j DNAT --to-destination 192.168.1.101:25

But a telnet to the old, external ip-address of the mailserver
just hangs (untill it returns a "No route to host".

Unfortunatly, I have copied parts from various firewall-scripts
around the net, but I think I'm understanding most of it now.

Below are different output from iptables -L
I could ask them to change MX to point to the firewall, but
I'm hoping to avoid it, if possible.

- M


# iptables -v -L -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere           tcp dpt:http to:192.168.1.101
    0     0 DNAT       tcp  --  eth1   any     anywhere             193.69.71.49       tcp dpt:smtp to:192.168.1.101

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    any     192.168.1.0/24       anywhere
    0     0 SNAT       all  --  any    eth0    anywhere             anywhere           to:193.69.71.49

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination


# iptables -v -L FORWARD
Chain FORWARD (policy ACCEPT 259 packets, 16059 bytes)
 pkts bytes target     prot opt in     out     source               destination
  486 29545 bad_tcp_packets tcp -- any any     anywhere       anywhere
    0     0 ACCEPT     tcp  --  eth1   eth0    anywhere             192.168.1.101      state NEW,RELATED,ESTABLISHED tcp dpt:smtp
  325 23403 ACCEPT     all  --  eth0   eth1    anywhere             anywhere
    4   355 LOG        all  --  any    any     anywhere             anywhere           limit: avg 3/min burst 3 LOG level debug prefix `IPT FORWARD packet died: '


# iptables -v -L INPUT
Chain INPUT (policy ACCEPT 6 packets, 759 bytes)
 pkts bytes target     prot opt in     out     source               destination
   99  7212 bad_tcp_packets  tcp  --  any    any     anywhere       anywhere
    2   318 ACCEPT     all  --  eth0   any     192.168.1.0/24       anywhere
    0     0 ACCEPT     all  --  lo     any     localhost.localdomain anywhere
    0     0 ACCEPT     all  --  lo     any     192.168.1.20         anywhere
   19  1444 ACCEPT     all  --  lo     any     x.x.x.49             anywhere
    0     0 ACCEPT     all  --  eth0   any     anywhere             192.168.1.255
    0     0 ACCEPT     udp  --  eth0   any     anywhere             anywhere           udp spt:bootpc dpt:bootps
  103  7797 ACCEPT     all  --  any    any     anywhere             x.x.x.49            state RELATED,ESTABLISHED
    0     0 tcp_packets  tcp  --  eth1   any     anywhere           anywhere
    2   292 udp_packets  udp  --  eth1   any     anywhere           anywhere
    0     0 icmp_packets  icmp --  eth1   any    anywhere           anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere           state NEW,ESTABLISHED tcp dpt:smtp
    6   759 LOG        all  --  any    any     anywhere             anywhere           limit: avg 3/min burst 3 LOG level debug prefix `IPT INPUT packet died: '


# iptables -v -L OUTPUT
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   94 13672 bad_tcp_packets  tcp  --  any    any     anywhere       anywhere
    0     0 ACCEPT     all  --  any    any     localhost.localdomain anywhere
    0     0 ACCEPT     all  --  any    any     192.168.1.20         anywhere
  128 16212 ACCEPT     all  --  any    any     x.x.x.49             anywhere
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere           state RELATED,ESTABLISHED tcp spt:smtp
    0     0 LOG        all  --  any    any     anywhere             anywhere           limit: avg 3/min burst 3 LOG level debug prefix `IPT OUTPUT packet died: '