I have IPTables setup and mostly working. I have two interface, inside & outside. All traffic from inside goes out and works fine. All traffice from outside goes where it should. My problem is that I have DNAT setup for two outside addresses to 2 inside addresses. From inside I can only access the boxes via their inside address, I can not access the outside address. Can someone please help me? I have been reading, and I believe I may need to use SNAT and/or add some DNAT statements. I am running on Fedora 10. Below is the /etc/sysconfig/iptables file with outside addresses top level masked.

*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth1 -j MASQUERADE
-A PREROUTING -p tcp -m tcp -d xx.xx.xx.21 -j DNAT --to-destination 192.168.100.3
-A PREROUTING -p tcp -m tcp -d xx.xx.xx.18 -j DNAT --to-destination 192.168.100.1
COMMIT
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:MASQ-FORWARD - [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -s 192.168.100.0/23 -o eth1 -j MASQ-FORWARD
-A MASQ-FORWARD -s 192.168.100.0/23 -o eth1 -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p all -s 192.168.100.0/23 -j ACCEPT
-A INPUT -p all -s xx.xx.xx.0/25 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -p udp -m udp --sport 3307 -j ACCEPT
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
-A INPUT -p udp -m udp --sport 13 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 13 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 20 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 21 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 69 -j ACCEPT
-A INPUT -p udp -m udp --sport 37 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 37 -j ACCEPT
-A INPUT -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 3307 --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 20 --state NEW -j ACCEPT
-A INPUT -p udp -m udp -m state --dport 20 --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 21 --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 80 --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 10000 --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -m state --dport 20000 --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
*mangle
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed

You are right. Just try SNAT.