iptables DNAT question with pppoe

[Ed Thomson <ethomson@ravecomm.com>]

Hi-

A little background first: I'm currently using iptables (linux kernel 2.4.25)
on my router with 5 ethernet segments.   eth0 is inbound from my ISP, eth1
and eth2 are routable IP space assigned by my provider, eth3 and eth4 are
private-numbered NATs.

I just got a DSL from my telco and I'm using PPPoE to connect it (eth5 on the
router) so that I can put a machine in for backup DNS and MX and manage it out
of this machine room.  We have 5 static IPs from our DSL provider, which if
it makes a difference, appears to really be a /29 by watching tcpdump on the
ppp interface.

The PPP is working, and the routes are correct so that the DSL IP addresses
are routed out properly from the DSL.  (ie, I can ping the DSL IP and ssh
to it.)

I have inbound port forwarding setup with DNAT rules on my primary provider's
interface, which work fine.  However, I'm trying to setup DNAT rules for my
DSL address and failing.

Here's what I'm trying to do:

iptables -A INPUT -i ppp0 --protocol tcp --destination-port 587 -j ACCEPT
iptables -A FORWARD -i ppp0 --protocol tcp --destination-port 587 -j ACCEPT
iptables -t nat -A PREROUTING --protocol tcp -i ppp0 --destination <dslip> --destination-port 587 -j DNAT --to <mailserver>:587

<dslip> is the IP address assigned to my DSL by the remote server
<mailserver> is the IP address of my mail server which is on eth1

Then, from a random machine not on my network, I can ping <dslip>, but when I
telnet to <dslip> port 587, the connection times out.  If I run tcpdump on ppp0,
I do see the inbound packet to port 587 from the remote machine.  If I run
tcpdump on eth1, I never see any packets to port 587.

I don't know if the input and forward ACCEPT rules are required, but I've
tried with and without.  The default rule for OUTPUT on the router is
ACCEPT.

I'm stumped, because this syntax works perfectly on the ethernet interface
from my primary provider.  This may be a routing problem, but I don't see it.
Is there any better diagnostics I can be doing to try to clear this up?

Thanks for any input.

Sincerely,
Ed Thomson <ethomson@ravecomm.com>