Found the problem...the GATEWAY on 20.246 was set to a different router 
and not the firewall.

It started working after I changed it--thanks for your help!!!

Willi Dyck wrote:

>On Tue, Feb 25, 2003 at 11:06:55AM -0700, Tom Smith wrote:
>  
>
>>Having problem forwarding 216.161.174.4 port 8241 to 192.168.20.246 port 22.
>>
>>I added the following rule to run DNAT:
>>$IPTABLES -t nat -A PREROUTING -p tcp -d 216.161.174.4 --dport 8241 -j 
>>DNAT --to-destination 192.168.20.246:22
>>    
>>
>
>Good.
>
>  
>
>>What I saw when trying to connect to the port from a remote host was:
>>uccinet kernel: IN=eth1 OUT=eth0 SRC=64.158.129.226 DST=192.168.20.246 
>>LEN=60 TOS=0x10 PREC=0x00 TTL=45 ID=63685 DF PROTO=TCP SPT=2030 DPT=22 
>>WINDOW=5840 RES=0x00 SYN URGP=0
>>
>>I later learned that I also needed some FORWARD rules to make it work. 
>>The default script had most of them. I added:
>>$IPTABLES -A FORWARD -d 192.168.20.246 -p tcp --dport 22 -j ACCEPT
>>    
>>
>
>Better. Much better would be a second rule which allows the way back
>from 192.168.20.246.
>
>$IPTABLES -A FORWARD -s 192.168.20.246 -p tcp --sport 22 -j ACCEPT
>
>What I see in your 'iptables -nL' output is that you allow everything
>in the FORWARD chain which has a state ESTABLISHED and/or RELATED, thus
>the second rule above isn't necessery. Does 192.168.20.246 have routing
>entry back to the inet? Also, what is the output of 'iptables -nvL
>FORWARD'?
>
>  
>
>>Chain FORWARD (policy DROP)
>>target     prot opt source               destination         
>>ACCEPT     tcp  --  0.0.0.0/0            192.168.20.246     tcp dpt:22 
>>ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED 
>>ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          
>>drop-and-log-it  all  --  0.0.0.0/0            0.0.0.0/0          
>>    
>>
>
>Regards -- Willi
>
>  
>