DNAT not working

[Balazs Fulop <balazs.fulop@initon.com>]

Dear List!

I have the following setup:
eth0 (WAN, with multiple alias IPs), eth1 (LAN1), eth2 (LAN2), eth3 (LAN3)

I would like to setup DNAT, in order to achieve the following:
packets coming from eth0 to a certain IP and tcp port get NATed to an IP 
and port for a machine on one of the LAN subnets

I have read the relevant HOWTO and made the following setup:
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use 
Iface
aaa.bbb.ccc.ddd   0.0.0.0         255.255.255.248 U     0      0        
0 eth0
192.168.5.0     0.0.0.0         255.255.255.0   U     0      0        0 eth3
192.168.4.0     0.0.0.0         255.255.255.0   U     0      0        0 eth2
192.168.3.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
0.0.0.0         aaa.bbb.ccc.eee   0.0.0.0         UG    0      0        
0 eth0
# cat /var/lib/iptables/testing
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*mangle
:PREROUTING ACCEPT [1804:164934]
:INPUT ACCEPT [1576:145710]
:FORWARD ACCEPT [208:12864]
:OUTPUT ACCEPT [988:111965]
:POSTROUTING ACCEPT [1239:130436]
COMMIT
# Completed on Fri Dec 22 14:23:36 2006
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*nat
:PREROUTING ACCEPT [58:10171]
:POSTROUTING ACCEPT [13:1459]
:OUTPUT ACCEPT [13:1459]
-A PREROUTING -d aaa.bbb.ccc.fff -i eth0 -p tcp -m tcp --dport 25 -j 
DNAT --to-destination 192.168.3.1
-A PREROUTING -j LOG --log-prefix "PREROUTING: " --log-level 7
COMMIT
# Completed on Fri Dec 22 14:23:36 2006
# Generated by iptables-save v1.3.5 on Fri Dec 22 14:23:36 2006
*filter
:INPUT ACCEPT [1576:145710]
:FORWARD ACCEPT [208:12864]
:OUTPUT ACCEPT [988:111965]
-A FORWARD -d 192.168.3.1 -i eth0 -o eth1 -p tcp -m tcp --dport 25 -j 
ACCEPT
-A FORWARD -j LOG --log-prefix "FORWARD: " --log-level 7
COMMIT
# Completed on Fri Dec 22 14:23:36 2006

If I telnet 192.168.3.1 25 on the firewall, an SMTP session starts. If I 
telnet from outside (coming on eth0), it waits until timeout. I just 
can't figure out why it is not working. At last I removed all the IP 
aliases, and it didn't work that way either. There is nothing relevant 
in /var/log/syslog. I have 1 in /proc/sys/net/ipv4/ip_forward.

Please help. Thanks in advance.

Yours sincerely,
    Fülöp Balázs