iptables

[Chap]

Ahoj,
mam router s ostrou adresou a chci jeden port z verejne IP presmerovat na konkretni PC v siti (abych mohl byt aktivni na DC).
mam takovouhle konfiguraci:
(1.2.3.4 je verejna IP)


iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -N tcp_segmenty
iptables -N udp_segmenty
iptables -A INPUT -p TCP -i ath0 -j tcp_segmenty
iptables -A INPUT -p UDP -i ath0 -j udp_segmenty
iptables -A udp_segmenty -p UDP --dport 5000 -j ACCEPT
iptables -A tcp_segmenty -p TCP --dport 5000 -j ACCEPT
iptables -A tcp_segmenty -p TCP --dport 80 -j ACCEPT
iptables -A tcp_segmenty -p TCP --dport 20 -j ACCEPT
iptables -A tcp_segmenty -p TCP --dport 21 -j ACCEPT
iptables -A tcp_segmenty -p TCP --dport 22 -j ACCEPT
iptables -A INPUT -p ICMP -i ath0 --icmp-type 0 -j ACCEPT
iptables -A INPUT -p ICMP -i ath0 --icmp-type 3 -j ACCEPT
iptables -A INPUT -p ICMP -i ath0 --icmp-type 8 -j ACCEPT
iptables -A INPUT -p ICMP -i ath0 --icmp-type 11 -j ACCEPT


iptables -A INPUT -p ALL -i eth0 -j ACCEPT
iptables -A INPUT -p ALL -i lo -j ACCEPT

iptables -A INPUT -j LOG

iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 192.168.10.1 -j ACCEPT
iptables -A OUTPUT -p ALL -s 1.2.3.4 -j ACCEPT
iptables -A OUTPUT -j LOG


iptables -A FORWARD -i eth0 -j ACCEPT
iptables -A FORWARD -i ath0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -o ath0 -j MASQUERADE
iptables


iptables -t nat -A POSTROUTING -o ath0 -j SNAT --to 1.2.3.4
iptables -t nat -A PREROUTING -p tcp -d 1.2.3.4 --dport 5000 -j DNAT --to 192.168.10.2
iptables -t nat -A PREROUTING -p udp -d 1.2.3.4 --dport 5000 -j DNAT --to 192.168.10.2

nevite co tam mam spatne nebo co mi tam chybi??
predem diky za radu
Chap