OK. I have a Slackware 9.1 machine that I use primarily as a firewall/router/webserver/distraction. I have managed to get IP Masquerading to work using the following commands:

>iptables -F; iptables -t nat -F; iptables -t mangle -F

>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

>echo 1 > /proc/sys/net/ipv4/ip_forward

>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

>iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT

>iptables -P INPUT DROP

The external interface is eth0 and the internal one is eth1. What I'm trying to do is get my windows box (which is behind the firewall) to use iTunes to connect to other people on the other side of the box (i.e. on the larger network I am connected to). I read a post from a Mac user who said that he had port 3689 open on his firewall for iTunes sharing. I tried to punch a hole in my firewall at port 3689 but I'm not sure which chain it's supposed to be in and I'm also no sure weather it's supposed to be destination port or source port. Anyway, here's a listing of my 'iptables -L' command. It's kind of a mess.

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:3689
ACCEPT tcp -- anywhere anywhere tcp spt:3689
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:3689
ACCEPT tcp -- anywhere anywhere tcp spt:3689

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:3689
ACCEPT tcp -- anywhere anywhere tcp dpt:3689

Hopefully someone can make sense of my post and help me figure this out. A quick and dirty iptables tutorial would be nice, but I'm not holding my breath.

Thanks in advance,
Phekno

check-out this web-based customized iptables script generator:

http://easyfwgen.morizot.net/gen/

are you natting? do you have private addesses behind? I.e 192.168.0.0/24?

I'm kinda "natting." I'm using IP Masquerading which, if I'm not mistaken, is not exactly the same as NAT. Anyway, the firewall is being used as a DHCP server for the internal network too. It will assign IP addresses from 192.168.0.2 - 192.168.0.200 to any system plugged into the internal network.

Hope this helps.

Later,
Phekno

okay, so what you're asking is how to forward port 3689 on your gateway to the windows box on the lan, right???

something like this should do it:

iptables -A FORWARD -p tcp -i eth0 --destination-port 3689 --destination 192.168.0.200 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 3689 -j DNAT --to-destination 192.168.0.200:3689

got there before I did Win32Sux......

I have an iptables firewall doing DHCP and BIND for my internal home network. Those lines Win32SUX put is how you do it. Ensure to put the prerouting rule in.