Port forward problem med IPTABLES|Nätverk / Internet|Forum|Nordichardware

Hej,
Jag har lite problem med portforward på min linux burk..

Internet -> Linuxburk -> internt nätverk.

Nu vill jag forwarda port 5900 från linuxburken till en dator på det interna nätet.
Men av nån anledning (fel i iptables scriptet) så vägrar den.

Här är de bitar jag tror har med saken att göra:

	echo "  Allow VNC forward"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 5900 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 5900 -j ACCEPT

	

	$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5900 -j DNAT --to 192.168.3.2:5900

	

Hela min rc.firewall

	#!/bin/sh

	

	FWVER=0.63

	

	echo -e "nnLoading simple rc.firewall version $FWVER..n"

	

	IPTABLES=/sbin/iptables

	LSMOD=/sbin/lsmod

	GREP=/bin/grep

	AWK=/bin/awk

	

	UNIVERSE="0.0.0.0/0"

	

	EXTIF="eth1"

	INTIF="eth0"

	

	echo "  External Interface: $EXTIF"

	echo "  Internal Interface: $INTIF"

	

	EXTIP="217.215.xxx.xxx"

	echo "  External IP: $EXTIP"

	

	INTNET="192.168.3.0/24"

	INTIP="192.168.3.1/24"

	

	echo "  Internal network: $INTNET"

	echo "  Internal IP: $INTIP"

	

	echo -en " loading modules: "

	

	echo "  - Verifying that all kernel modules are ok"

	/sbin/depmod -a

	

	echo -en "ip_tables, "

	if [ -z ` $LSMOD | $GREP ip_tables | $AWK {'print $1'} ` ]; then

	   /sbin/insmod ip_tables

	fi

	

	echo -en "ip_conntrack, "

	if [ -z ` $LSMOD | $GREP ip_conntrack | $AWK {'print $1'} ` ]; then

	   /sbin/insmod ip_conntrack

	fi

	

	echo -e "ip_conntrack_ftp, "

	if [ -z ` $LSMOD | $GREP ip_conntrack_ftp | $AWK {'print $1'} ` ]; then

	   /sbin/insmod ip_conntrack_ftp

	fi

	

	echo -en "ip_conntrack_irc, "

	if [ -z ` $LSMOD | $GREP ip_conntrack_irc | $AWK {'print $1'} ` ]; then

	   /sbin/insmod ip_conntrack_irc

	fi

	

	echo -en "iptable_nat, "

	if [ -z ` $LSMOD | $GREP iptable_nat | $AWK {'print $1'} ` ]; then

	   /sbin/insmod iptable_nat

	fi

	

	echo -e "ip_nat_ftp"

	if [ -z ` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} ` ]; then

	   /sbin/insmod ip_nat_ftp

	fi

	echo " Done loading Modules"

	

	echo "  enabeling forwarding..."

	echo "1" > /proc/sys/net/ipv4/ip_forward

	

	echo "  clearing any rules and setting default policy.."

	$IPTABLES -P INPUT DROP

	$IPTABLES -F INPUT

	$IPTABLES -P OUTPUT DROP

	$IPTABLES -F OUTPUT

	$IPTABLES -P FORWARD DROP

	$IPTABLES -F FORWARD

	$IPTABLES -F -t nat

	

	$IPTABLES -F drop-and-log-it

	

	$IPTABLES -X

	$IPTABLES -Z

	

	echo "  Creating a drop chain.."

	$IPTABLES -N drop-and-log-it

	$IPTABLES -A drop-and-log-it -j LOG --log-level 4

	$IPTABLES -A drop-and-log-it -j DROP

	

	echo "  FWD: Allow all out and only existing ones in"

	# loopback is ok.

	# local address is ok.

	# external pretending to be local is not ok.

	$IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

	$IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j drop-and-log-it

	

	# ping

	$IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT

	

	# related masq traffic is ok.

	$IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT

	

	# IN

	# allow other traffic, drop all not listed below.

	

	echo "  Allow www access"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT

	

	echo "  Allow ftp access"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 21 -j ACCEPT

	

	echo "  Allow ssh access"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 22 -j ACCEPT

	

	echo "  Allow CS server"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 27015 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 27015 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 27011 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 27011 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 27500 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 27012 -j ACCEPT

	

	echo "  Allow VNC forward"

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 5900 -j ACCEPT

	$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p udp -s $UNIVERSE -d $EXTIP --dport 5900 -j ACCEPT

	

	#drop the rest

	$IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it

	

	# out

	$IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT

	$IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT

	$IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT

	$IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j drop-and-log-it

	$IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT

	

	$IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j drop-and-log-it

	

	#$IPTABLES -A OUTPUT -s $UNIVERSE -d $EXTIP

	echo "  Enable ip masq"

	

	$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT

	$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

	

	$IPTABLES -A FORWARD -j drop-and-log-it

	

	$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 443 -j DNAT --to $EXTIP:22

	$IPTABLES -t nat -A PREROUTING -p udp -d $EXTIP --dport 443 -j DNAT --to $EXTIP:22

	

	$IPTABLES -t nat -A PREROUTING -p tcp -d $EXTIP --dport 5900 -j DNAT --to 192.168.3.2:5900

	$IPTABLES -t nat -A POSTROUTING -o $EXTIF -s $INTNET -j SNAT --to-source $EXTIP

	

	$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

	#$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP

	

	echo -e "n rc.firewall-2.4 v$FWVER done.n"

	

Nån som har koll på iptables och kan se vad jag gör för fel?