Есть федорка 8ая. Она же шлюз. IP - 192.168.2.1
eth1 - локаль
eth0 - инторнеть
За шлюзом стоит 2008 вындовз. IP - 192.168.2.2
Добавил правила в ойпитейблс
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.2.2
-A INPUT -p tcp -m state -m tcp --dport 3389 --state NEW -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.2.2 --sport 3389 -j ACCEPT
Не пустило.
Причем если через путти делать туннель - пускает.
Вот конфиг айпитейблс в целом
[root@mail ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.1.1 on Wed Aug 27 18:17:47 2008
*mangle
:PREROUTING ACCEPT [11:722]
:INPUT ACCEPT [11:722]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:568]
:POSTROUTING ACCEPT [6:568]
#-A POSTROUTING -o eth0 -j TTL --ttl-set 64
COMMIT
# Completed on Wed Aug 27 18:17:47 2008
# Generated by iptables-save v1.4.1.1 on Wed Aug 27 18:17:47 2008
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.2.2
-A PREROUTING -p tcp -m tcp -d [MY_REAL_IP] --dport 3000 -j DNAT --to-destination 192.168.2.49
# XML
-A PREROUTING -p tcp -m tcp -d [MY_REAL_IP] --dport 8000 -j DNAT --to-destination 192.168.2.106:22
-A POSTROUTING -p tcp -m tcp -d 192.168.2.106 --dport 22 -j SNAT --to-source [MY_REAL_IP]
-A PREROUTING -p tcp -m tcp -d 192.168.2.1 --dport 3000 -j DNAT --to-destination 192.168.2.49
-A PREROUTING -p tcp -m tcp -d [MY_REAL_IP] --dport 3690 -j DNAT --to-destination 192.168.2.49
#-A PREROUTING -p tcp -m tcp -i eth1 --dport 3389 -j DNAT --to-destination 192.168.2.2
#-A POSTROUTING -p tcp -s 192.168.2.2 --sport 3389 -j SNAT --to-source [MY_REAL_IP]
-A POSTROUTING -p tcp -m tcp -d 192.168.2.49 --dport 80 -j SNAT --to-source [MY_REAL_IP]
-A POSTROUTING -p tcp -m tcp -d 192.168.2.49 --dport 3690 -j SNAT --to-source [MY_REAL_IP]
-A POSTROUTING -o eth0 -j SNAT --to-source [MY_REAL_IP]
COMMIT
*raw
:PREROUTING ACCEPT [0:0]
COMMIT
# Completed on Wed Aug 27 18:17:47 2008
# Generated by iptables-save v1.4.1.1 on Wed Aug 27 18:17:47 2008
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A INPUT -p 47 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 22 --state NEW -j ACCEPT
-A INPUT -p udp -m udp -s 0/0 --dport 161:162 -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 25 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 80 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 10000 --state NEW -j ACCEPT
# secure IMAP
-A INPUT -p tcp -m state -m tcp --dport 993 --state NEW -j ACCEPT
# secure pop3
-A INPUT -p tcp -m state -m tcp --dport 995 --state NEW -j ACCEPT
# another smtp
-A INPUT -p tcp -m state -m tcp --dport 465 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 3389 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 2525 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 1723 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 8080 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 8000 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 20:21 --state NEW -j ACCEPT
-A INPUT -p tcp -m state -m tcp --dport 1025:1030 --state NEW -j ACCEPT
# blockall
-A INPUT -j REJECT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.2.2 --sport 3389 -j ACCEPT
-A FORWARD -p tcp -m tcp -o eth0 --dport 25 -j LOG
-A FORWARD -p tcp -m tcp -o eth0 --dport 25 -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j ACCEPT
COMMIT
