Posrt forwarding not working

Are you sure you have forwarding active?
echo "1" >/proc/sys/net/ipv4/ip_forward

echo "1" >/proc/sys/net/ipv4/ip_forward
The new file ip_forward now has a "1" in it.
Executing : iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209:8080
RETURNS: iptables: No chain/target/match by that name

Please help!

specify nat table (instead of default filter table):
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209:8080

Tx. Still no luck:
This is the log: and shows connection  -please help!
193: Aug 24 10:01:20 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18160 DF PROTO=TCP SPT=4052 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
194: Aug 24 10:01:23 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18194 DF PROTO=TCP SPT=4052 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
196: Aug 24 10:01:29 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18241 DF PROTO=TCP SPT=4053 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
213: Aug 24 10:01:31 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18284 DF PROTO=TCP SPT=4054 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
217: Aug 24 10:01:34 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18312 DF PROTO=TCP SPT=4054 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
218: Aug 24 10:01:40 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18384 DF PROTO=TCP SPT=4054 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
219: Aug 24 10:01:52 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18760 DF PROTO=TCP SPT=4058 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0
220: Aug 24 10:01:55 trixbox1 kernel: IN=ppp0 OUT=eth0 SRC=144.146.153.69 DST=192.168.10.209 LEN=48 TOS=0x00 PREC=0x00 TTL=124 ID=18864 DF PROTO=TCP SPT=4058 DPT=8080 WINDOW=65535 RES=0x00 SYN URGP=0

Your input interface is ppp0 not eth0:
iptables -t nat -A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209:8080

*nat
:PREROUTING ACCEPT [114:14045]
:POSTROUTING ACCEPT [263:17744]
:OUTPUT ACCEPT [213:15344]
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080:8888 -j DNAT --to-destination 192.168.10.209:8080
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209:8080
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209:8080
COMMIT

As you can see ppp0 is specified but I still get the log as above???????

Could you post your current filter section - the rules above do not do any logging. And actually allow all connections!

*mangle
:PREROUTING ACCEPT [527579:41491490]
:INPUT ACCEPT [527235:41464566]
:FORWARD ACCEPT [236:11328]
:OUTPUT ACCEPT [637726:52022343]
:POSTROUTING ACCEPT [637962:52033671]
-A OUTPUT -p udp -m udp --sport 4569 -j DSCP --set-dscp 0x2e
-A OUTPUT -p udp -m udp --sport 10000:20000 -j DSCP --set-dscp 0x2e
-A OUTPUT -p udp -m udp --sport 5060 -j DSCP --set-dscp 0x2e
COMMIT
# Completed on Mon Aug 24 12:18:49 2009
# Generated by iptables-save v1.3.5 on Mon Aug 24 12:18:49 2009
*nat
:PREROUTING ACCEPT [278:28278]
:POSTROUTING ACCEPT [656:44806]
:OUTPUT ACCEPT [559:40150]
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080:8888 -j DNAT --to-destination 192.168.10.209:8080
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 23 -j DNAT --to-destination 192.168.10.209:23
COMMIT
# Completed on Mon Aug 24 12:18:49 2009
# Generated by iptables-save v1.3.5 on Mon Aug 24 12:18:49 2009
*filter
:INPUT ACCEPT [30:1440]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [637726:52022343]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -i ppp0 -p tcp -m tcp --dport 23 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 8080:8082 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1021 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1022 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 1023 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 5060 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 10000:20000 -m state --state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 4569 -m state --state NEW -j ACCEPT
COMMIT
# Completed on Mon Aug 24 12:18:49 2009

I've run this and confirmed change to 1. echo "1" >/proc/sys/net/ipv4/ip_forward
However when service network restart is run it changes back to 0 ?!!!!

I don't know about the specifics of Red Hat i usually write my own scripts.
Can you give me the output of following commands: "iptables -L -nv" and "iptables -L -nv -t nat"
I can make you script from the output and also fix your problem.

edit /etc/sysctl.conf to look like:
net.ipv4.ip_forward = 1

Changes to sysctl.conf take effect upon booting. If you want changes to take effect without rebooting, use the following:  
# sysctl -p


now when you try to check if traffic is flowing through one of your rules, issue:

for FILTER table:
iptables -L -vn

for NAT table:
iptables -L -vn -t nat


if you still have problems after editing the sysctl.conf and restart, then I would recommend to move this rule:
-A FORWARD -j RH-Firewall-1-INPUT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

to look like
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j RH-Firewall-1-INPUT


This is before looking the output of the iptables -L command ;-)

Best,
Gabriel

Redimido: Tx 4 the detailed help. Still having problem.
Millenium: See paste below:

[root@localhost sysconfig]# iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        
 7356  339K RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0          

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 RH-Firewall-1-INPUT  all  --  *      *       0.0.0.0/0            0.0.0.0/0          

Chain OUTPUT (policy ACCEPT 9395 packets, 10M bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination        
 7347  337K ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0          
    2   100 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          
    5  1219 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:23 state NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22 state NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:1022 state NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:1023 state NEW
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            141.2.39.6         tcp dpt:5060 state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            141.2.39.6         udp dpts:10000:20000 state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            141.2.39.6         state NEW udp dpt:4569
    0     0 LOG        all  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp flags:!0x17/0x02 LOG flags 0 level 4 prefix `ALERT,NewNotSyn from eth:'
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp flags:!0x17/0x02
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02 LOG flags 0 level 4 prefix `ALERT,NEW FROM eth DROP:'
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x17/0x02
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8 LOG flags 0 level 4 prefix `ALERT PING DROP:'
    0     0 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0           icmp type 8
    2   186 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0           LOG flags 0 level 4 prefix `ALERT, REST INPUT DROP:'
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          
[root@localhost sysconfig]#
_________________________________
[root@localhost sysconfig]# iptables -L -vn -t nat
Chain PREROUTING (policy ACCEPT 11 packets, 1264 bytes)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 DNAT       tcp  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           tcp to:192.168.10.108:23

Chain POSTROUTING (policy ACCEPT 34 packets, 2082 bytes)
 pkts bytes target     prot opt in     out     source               destination        

Chain OUTPUT (policy ACCEPT 34 packets, 2082 bytes)
 pkts bytes target     prot opt in     out     source               destination        
[root@localhost sysconfig]#

Attached goes a script that probably will fix your problems.
Place it at /etc/init.d/firewall and do a "chmod 700 /etc/init.d/firewall" then execute it.

Notice that Red Hat/CentOS use a single chain for both FORWARD and INPUT chains, so i can't really tell what is trafic is directed to the box and what is supposed to go thru (If that is your firewall, INPUT is probably just port 22).

Also i removed all the logging, that can be added later. To debug the access, use tcpdump instead (run it like this "tcpdump -i any host 144.146.153.69 -vn") and you should be able to see the NAT and the Foward.

Please let me know the result.

#!/bin/sh
 
#Variables
IPTABLES=/sbin/iptables
 
#Clean the chains, define policies and set it stateful
 
$IPTABLES -L -n | awk '/Chain/ {printf "iptables -F %s\n", $2;}'|/bin/sh
$IPTABLES -t nat -L -n | awk '/Chain/ {printf "iptables -t nat -F %s\n", $2;}'|/bin/sh
$IPTABLES -X
$IPTABLES -t nat -X
 
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
 
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 
#Loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
 
#Allows access to the box
$IPTABLES -A INPUT -m state --state NEW -p tcp -m multiport --dport 22,25,1022,1023 -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -i eth0 -j ACCEPT
 
#Allows certain trafic go trhu the box
$IPTABLES -A FORWARD -m state --state NEW -i eth0 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -p tcp -m multiport --dport 22,25,1022,1023 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p tcp --dport --dport 5060 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p udp --dport --dport 4569 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p udp --dport --dport 10000:20000 -j ACCEPT
 
#Port forwarding
$IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 8080 -j DNAT --to-dest 192.168.10.209
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.209 -p tcp --dport 8080 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 23 -j DNAT --to-dest 192.168.10.108
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.108 -p tcp --dport 8080 -j ACCEPT

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:

Tx, but get

[root@localhost init.d]# chmod 700 firewall
[root@localhost init.d]# ./firewall
iptables v1.3.5: invalid TCP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: invalid UDP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: invalid UDP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
[root@localhost init.d]# service firewall stop
iptables v1.3.5: invalid TCP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: invalid UDP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
iptables v1.3.5: invalid UDP port/service `--dport' specified
Try `iptables -h' or 'iptables --help' for more information.
[root@localhost init.d]#

it was a typo i made shaunwingin, i've fixed it, here's the new script.

#!/bin/sh
 
#Variables
IPTABLES=/sbin/iptables
 
#Clean the chains, define policies and set it stateful
 
$IPTABLES -L -n | awk '/Chain/ {printf "iptables -F %s\n", $2;}'|/bin/sh
$IPTABLES -t nat -L -n | awk '/Chain/ {printf "iptables -t nat -F %s\n", $2;}'|/bin/sh
$IPTABLES -X
$IPTABLES -t nat -X
 
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
 
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
 
#Loopback
$IPTABLES -A INPUT -i lo -j ACCEPT
 
#Allows access to the box
$IPTABLES -A INPUT -m state --state NEW -p tcp -m multiport --dport 22,25,1022,1023 -j ACCEPT
$IPTABLES -A INPUT -m state --state NEW -i eth0 -j ACCEPT
 
#Allows certain trafic go trhu the box
$IPTABLES -A FORWARD -m state --state NEW -i eth0 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -p tcp -m multiport --dport 22,25,1022,1023 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p tcp --dport 5060 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p udp --dport 4569 -j ACCEPT
$IPTABLES -A FORWARD -m state --state NEW -d 141.2.39.6 -p udp --dport 10000:20000 -j ACCEPT
 
#Port forwarding
$IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 8080 -j DNAT --to-dest 192.168.10.209
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.209 -p tcp --dport 8080 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -i ppp0 -p tcp --dport 23 -j DNAT --to-dest 192.168.10.108
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.108 -p tcp --dport 8080 -j ACCEPT

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:

Tx. Still not getting through...
tcpdump -i any host 144.146.153.69 -vn
What ip must I use? Please explain it

If you know the source ip, use it, you going to be able to see every packet. If you don't know, run it like this: "tcpdump -i any port 8080 -vn"
Please paste the output here so i can see what's going on but it's kinda hard to think that it doesn't work, such a simple script.
Would help as well if you told me how is your network set up, can you give us the following info:

On the firewall:
"ifconfig -a"
"route -n"

On the machine that you directing the port 8080 (with the ip 192.168.10.209):
If its a windows:
"ipconfig /all"
"route print"

If its a linux:
"ifconfig -a"
"route -n"

Tx. Please see attached.

Also a telnet attempt from a public pc:
[root@localhost init.d]# tcpdump -i any port 23 -vn
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
20:59:11.582094 IP (tos 0x0, ttl  54, id 33392, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 196.146.152.179.telnet: S, cksum 0x3b1c (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579708988 0,nop,wscale 7>
20:59:11.583753 IP (tos 0x0, ttl  53, id 33392, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 192.168.10.108.telnet: S, cksum 0xae4d (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579708988 0,nop,wscale 7>
20:59:14.577767 IP (tos 0x0, ttl  54, id 33393, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 196.146.152.179.telnet: S, cksum 0x2f64 (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579711988 0,nop,wscale 7>
20:59:14.577804 IP (tos 0x0, ttl  53, id 33393, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 192.168.10.108.telnet: S, cksum 0xa295 (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579711988 0,nop,wscale 7>
20:59:20.578571 IP (tos 0x0, ttl  54, id 33394, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 196.146.152.179.telnet: S, cksum 0x17f4 (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579717988 0,nop,wscale 7>
20:59:20.578614 IP (tos 0x0, ttl  53, id 33394, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 192.168.10.108.telnet: S, cksum 0x8b25 (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579717988 0,nop,wscale 7>

6 packets captured
6 packets received by filter
0 packets dropped by kernel
[root@localhost init.d]#

[root@localhost init.d]# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:02:E3:4C:A0:05  
          inet addr:192.168.10.77  Bcast:192.168.10.255  Mask:255.255.255.0
          inet6 addr: fe80::202:e3ff:fe4c:a005/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4691230 errors:9 dropped:1 overruns:0 frame:0
          TX packets:2411342 errors:0 dropped:0 overruns:0 carrier:0
          collisions:443796 txqueuelen:1000 
          RX bytes:1000184097 (953.8 MiB)  TX bytes:1909684594 (1.7 GiB)
          Interrupt:201 
 
eth1      Link encap:Ethernet  HWaddr 00:06:4F:7D:17:05  
          inet addr:192.168.1.100  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::206:4fff:fe7d:1705/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:250610 errors:0 dropped:0 overruns:0 frame:0
          TX packets:253478 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:45351619 (43.2 MiB)  TX bytes:53170020 (50.7 MiB)
          Interrupt:177 Base address:0xcc00 
 
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:138986 errors:0 dropped:0 overruns:0 frame:0
          TX packets:138986 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:36370929 (34.6 MiB)  TX bytes:36370929 (34.6 MiB)
 
ppp0      Link encap:Point-to-Point Protocol  
          inet addr:196.146.152.179  P-t-P:196.146.152.1  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:12142 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12511 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:2659461 (2.5 MiB)  TX bytes:854171 (834.1 KiB)
 
sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
 
RESULTS of TELNET from the Linux Machine to linux machine.
______________
[root@localhost rc.d]# telnet 196.146.152.179
Trying 196.146.152.179...
telnet: connect to address 196.146.152.179: Connection refused
telnet: Unable to connect to remote host: Connection refused
[root@localhost rc.d]# 
 
______________
[root@localhost init.d]# tcpdump -i any port 23 -vn
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
20:54:27.473517 IP (tos 0x10, ttl  64, id 44654, offset 0, flags [DF], proto: TCP (6), length: 60) 196.146.152.179.43256 > 196.146.152.179.telnet: S, cksum 0x7ec6 (correct), 2565325043:2565325043(0) win 32792 <mss 16396,sackOK,timestamp 548957853 0,nop,wscale 4>
20:54:27.473657 IP (tos 0x10, ttl  64, id 0, offset 0, flags [DF], proto: TCP (6), length: 40) 196.146.152.179.telnet > 196.146.152.179.43256: R, cksum 0x3059 (correct), 0:0(0) ack 2565325044 win 0
______
the route -n is too large to paste -  but I can sent you specifics.
_________
 Generated by iptables-save v1.3.5 on Sun Aug 30 19:00:34 2009
*mangle
:PREROUTING ACCEPT [272995:22583995]
:INPUT ACCEPT [272986:22583459]
:FORWARD ACCEPT [9:536]
:OUTPUT ACCEPT [330963:239886877]
:POSTROUTING ACCEPT [331695:239910301]
-A OUTPUT -p udp -m udp --sport 4569 -j DSCP --set-dscp 0x2e
-A OUTPUT -p udp -m udp --sport 10000:20000 -j DSCP --set-dscp 0x2e
-A OUTPUT -p udp -m udp --sport 5060 -j DSCP --set-dscp 0x2e
COMMIT
# Completed on Sun Aug 30 19:00:34 2009
# Generated by iptables-save v1.3.5 on Sun Aug 30 19:00:34 2009
*nat
:PREROUTING ACCEPT [7104:721834]
:POSTROUTING ACCEPT [46121:2824988]
:OUTPUT ACCEPT [46121:2824988]
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.10.209
-A PREROUTING -i ppp0 -p tcp -m tcp --dport 23 -j DNAT --to-destination 192.168.10.108
COMMIT
# Completed on Sun Aug 30 19:00:34 2009
# Generated by iptables-save v1.3.5 on Sun Aug 30 19:00:34 2009
*filter
:INPUT DROP [12:1116]
:FORWARD DROP [8:480]
:OUTPUT ACCEPT [80:4914]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m multiport --dports 22,25,1022,1023 -j ACCEPT
-A INPUT -i eth0 -m state --state NEW -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -m state --state NEW -j ACCEPT
-A FORWARD -p tcp -m state --state NEW -m multiport --dports 22,25,1022,1023 -j ACCEPT
-A FORWARD -d 141.2.39.6 -p tcp -m state --state NEW -m tcp --dport 5060 -j ACCEPT
-A FORWARD -d 141.2.39.6 -p udp -m state --state NEW -m udp --dport 4569 -j ACCEPT
-A FORWARD -d 141.2.39.6 -p udp -m state --state NEW -m udp --dport 10000:20000 -j ACCEPT
-A FORWARD -d 192.168.10.209 -i ppp0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.10.108 -i ppp0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Sun Aug 30 19:00:34 2009
 
 
_______
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:

The attached code means that the NAT/Forward rules (which is what you call port forward) is working, the packed entered in the ppp0, was redirected to the internal ip 192.168.10.108. The ttl changes means he crossed the box (forward rule) and the you can see that he translated the destination ip.
What is happening is that the internal computer is either filtering the packets or its route to the ip 141.222.39.3 is not configured (he either has a specific route that host/network configured wrongly or has no default route configured at all).
To fix that i really need the routing table in both machines and ip configuration for the machine with the ip 192.168.10.108, if it's too big to paste, please copy/paste in a txt file and attach it here.
Also, please don't use any built-in firewall commands as "iptables-save", they aren't needed anymore. Just run once the file /etc/init.d/firewall, then run "chkconfig firewall on" and "chkconfig iptables off", that will enable the firewall rules i created for you at boot.
If you need to change/create/delete any rule, simple edit the file ("vi /etc/init.d/firewall") and run again the script.
Last but not least, try to do a telnet from the box to the internal machine and see if it connects (telnet 192.168.10.108), that will help us debug.

[root@localhost init.d]# tcpdump -i any port 23 -vn
tcpdump: WARNING: Promiscuous mode not supported on the "any" device
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
20:59:11.582094 IP (tos 0x0, ttl  54, id 33392, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 196.146.152.179.telnet: S, cksum 0x3b1c (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579708988 0,nop,wscale 7>
20:59:11.583753 IP (tos 0x0, ttl  53, id 33392, offset 0, flags [DF], proto: TCP (6), length: 60) 141.222.39.3.34130 > 192.168.10.108.telnet: S, cksum 0xae4d (correct), 2177664076:2177664076(0) win 5840 <mss 1412,sackOK,timestamp 3579708988 0,nop,wscale 7>

                                              

1:
2:
3:
4:
5:

Just to help explaining, so you understand Better:

> [root@localhost rc.d]# telnet 196.146.152.179
> Trying 196.146.152.179...
> telnet: connect to address 196.146.152.179: Connection refused
> telnet: Unable to connect to remote host: Connection refused

You are trying to connect not to the internal machine with this, but to the own box and your NAT is only for the packets that comes from the interface ppp0 (internet packets) not lo (loopback) so it won't redirect it and since the own box has no telnet server running, you gonna get a connection refuse (the box isn't listenning on the port tcp 23).

Tx.
Route attached.
[root@localhost init.d]# telnet 192.168.10.108
Trying 192.168.10.108...
Connected to 192.168.10.108 (192.168.10.108).
Escape character is '^]'.

<1cf7d32f> Login:

Since you a have ppp device in there i assume that is the routing table for the firewall. I really gotta ask this, why do you have so many specific routes for internet address instead of a simple default route (everything points to ppp0 regardless) ?
Anyway, you have no route for the network/ip 141.222.39.3 and that is one of the causes but i still suspect that the internal machine (192.168.10.108) has issues related to ip configuration/routing.
Can you attach the routing table and the ip configuration for that machine also ?

Btw, this is a sign that the service is running and is reachable from the firewall:

> root@localhost init.d]# telnet 192.168.10.108
> Trying 192.168.10.108...
> Connected to 192.168.10.108 (192.168.10.108).
> Escape character is '^]'.

So it's PROBABLY just routing issues.

In South Africa local bandwidth is charged at about a quarter the price of international bandwdith. ppp0 is a local only connection and etho is attached to the international gateway and hence the routes.
There is only one linux machine and the firewall is running on it. The ifconfig and route tables I've attached are for it.
I think you are correct in your assesment.

> In South Africa local bandwidth is charged at about a quarter the price of international bandwdith. ppp0 is a local only connection and etho is attached to the international gateway and hence the routes.

Alright, then for that linux you need to add a route for the network 141.222.0.0/16 (or one route specific for the ip 141.222.39.3).

> There is only one linux machine and the firewall is running on it. The ifconfig and route tables I've attached are for it.

Yes but i still need to check the routing table and ip configuration for the machine 192.168.10.108, my guess is that there is the problem.
If its a windows you can get that data using "ipconfig -a" and "route print".

oh sorry 192.168.10.108 is a Quintum device and I cna't find the command to display the route table.
However I've changed its route to 192.168.10.77 which is the ip of the Linux eth0 its attached to but still no joy.

Tx it works.
Previously I had changed the last line:
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.108 -p tcp --dport 8080 -j ACCEPT
to
$IPTABLES -A FORWARD -m state --state NEW -i ppp0 -d 192.168.10.108 -p tcp --dport 23-j ACCEPT
and did the same this time.