Nat+Iptables+Tcp Keepalive Problem

[Emiliano Romero <emilianoromero@gmail.com>]

Hi list!, I dont know if I'm doing right posting this problem here.

I'm doing a DNAT to forward connections to port 5555 to another server. 
The connection gets forwarded fine, I can connect, send and recieve data 
over that connection. The problem appear with TCP KeepAlive packets (No 
flags, win=0, len=0). When that packets of a connection that is 
ESTABLISHED (Send and recieve data before) arrives to my iptables 
machine. They arent matched with nat entries of the conection where it 
belongs. So they are marked as INVALID and go to INPUT insted of FORWARD.

TCP Keepalive in the remote side (The one that start the connection) is 
seted at 20 seconds with 4 tries at 10 seconds each one. That's because 
it's over a very bad communication channel.

I add some of my configurations:

Iptables config:
iptables -t raw -A PREROUTING -p tcp --dport 5555 -j TRACE
iptables -t nat -A PREROUTING -p tcp --dport 5555 -j DNAT 
--to-destination 192.168.1.100:5555

Output of Trace: http://pastebin.com/f65e41319

Visual Output of Wireshark of another try: http://tinyurl.com/qlaj9n

# iptables --version
iptables v1.4.1.1

# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

# iptables -t nat -S
-P PREROUTING ACCEPT
-P POSTROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -p tcp -m tcp --dport 5555 -j DNAT --to-destination 
192.168.1.100:5555

# iptables -t raw -S
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT
-A PREROUTING -p tcp -m tcp --dport 5555 -j TRACE

WireShark output of TCP Keepalives:
186449    11772.258110    200.49.201.26=>172.16.102.11    TCP    [TCP 
ZeroWindow] [TCP Keep-Alive] 14032 > 5555 [] Seq=10 Win=0 Len=0
188417    11835.763745    172.16.102.11=>200.49.201.26    TCP    5555 > 
48538 [RST, ACK] Seq=1012825070 Ack=10 Win=0 Len=0

Any idea of what could be happening? Maybe that's not supported. If 
that's the case I'd never develop a kernel module, but I could try.

Regards