Suse 9.1 port forwarding woes

[Nathan March <nmarch@overdrawn.net>]

Despite my best attempts, I cannot seem to get port forwarding working 
on a suse 9.1 machine using iptables.

My firewall.sh:

#!/bin/bash

IPTABLES='/usr/sbin/iptables'

EXTIF='eth0'
INTIF1='eth1'
INTIF2='eth2'

/bin/echo 1 > /proc/sys/net/ipv4/ip_forward

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X

$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

$IPTABLES -A FORWARD -m state --state ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -p icmp -m state --state RELATED -j ACCEPT


$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state 
NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -m state --state 
NEW,ESTABLISHED -j ACCEPT

$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 25 -j ACCEPT
$IPTABLES -A INPUT --protocol tcp --dport 143 -j ACCEPT

$IPTABLES -A FORWARD -i eth0 -d 192.168.0.3 --protocol tcp --dport 80 -j 
ACCEPT
$IPTABLES -A PREROUTING -i eth0 -t nat -p tcp --dport 80 -j DNAT --to 
192.168.0.3:80


After the script runs:
linux:~ # iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:imap

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere            state 
ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere            state RELATED
ACCEPT     all  --  anywhere             anywhere            state 
NEW,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state 
NEW,ESTABLISHED
ACCEPT     tcp  --  anywhere             192.168.0.3         tcp 
dpt:http flags:FIN,SYN,RST,ACK/SYN state NEW

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
linux:~ # iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        
DNAT       tcp  --  anywhere             anywhere            tcp 
dpt:http to:192.168.0.3

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination        
MASQUERADE  all  --  anywhere             anywhere           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Anyone have any ideas what I'm doing wrong?

Thanks,
Nathan