I'm nore sure why port forwarding is really nessessary.
If your eth0 is connected directly to your cable modem,
then your eth0 IP should be your actual internet IP address.
All packets coming into and out of your eth0 interface
will be filtered by your INPUT and OUTPUT chains.
If you had a server or router in between your cable modem
and host computer, then you could configure
port forwarding on that device, or better yet, allow
that traffic through, so your whole network can recieve it.
By adding the suggested rules, you open a range of ports,
allowing applications listening to that range to communicate.
In this case Bittorrent. As far as what ports
it uses, I'm not sure, but you may want to look into that. It's
possible that when someone connects to you, they use
the destination ports you expect, yet with completely different
source ports. So how would you communicate the other way?
Your rules would only allow one way
communcation, the direction depending on which rules you've
matched to which chain. A solution would be to log the traffic and
note the ports used, or to specify both directions in your rules.
Code:
iptables -A INPUT -p tcp --dport 6881:6889 -j ACCEPT
iptables -A INPUT -p udp --dport 6881:6889 -j ACCEPT
iptables -A INPUT -p tcp --sport 6881:6889 -j ACCEPT
iptables -A INPUT -p udp --sport 6881:6889 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 6881:6889 -j ACCEPT
iptables -A OUTPUT -p udp --dport 6881:6889 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 6881:6889 -j ACCEPT
iptables -A OUTPUT -p udp --sport 6881:6889 -j ACCEPT
As far as the clarification of port forwarding and FOWARD:
It is possible to enable forwarding of packets between
multiple devices, such as if you had two network cards,
and wanted to share an internet connction.
# echo "1" > /proc/sys/net/ipv4/ip_forward
This, in combination with iptables rules would allow you
to share a connection through MASQUERADING, or
even enable port forwarding rules. These could, for
instance, forward (send) all packets destined for
a certain port, to a certain computer. This is done
through SNAT rules in the PREROUTING chain of the
nat table (iptables -L -t nat)
Your FOWARD chain filters the packets that are forwarded,
for instance, eth0 to eth1. It is like your INPUT, OUTPUT
chains in that it is designed for accepting and rejecting packets
based on what you specify.
Hope this helps
