Help with IPTables rules to use!!

Hi to all,

I have three PCs - A, B and C. I dnat traffic from A to B via C. C is
basically a firewall (both Ebtables/IPTables filtering). All three PCs
have 1 NIC (eth0). I am using a restrictive IPTables firewall. I use
Iperf to send TCP traffic from A to B. However, the setup doesn't
work. I dont know what IPTables rules to use to match the traffic. Can
s.o pls help me out? Given below are my scripts (on PC C) and traffic logs.

Warm regards,
Visham


My Ebtables ruleset is as follows:
------------------------------------------------------------------------------------
brctl addbr br0
brctl stp br0 off
brctl addif br0 eth0
ifconfig br0 0.0.0.0
ifconfig eth0 0.0.0.0 down
ifconfig br0 up
ifconfig eth0 up

ebtables -F
ebtables -Z
ebtables -t nat -F
#ebtables -P FORWARD DROP

ebtables -A INPUT -p ARP -d 00:0f:3d:cd:c5:5a -i ! eth1 -j DROP
ebtables -A INPUT -p ARP --arp-ip-dst 192.168.0.110 -i ! eth1 -j DROP
ebtables -A OUTPUT -p ARP -s 00:0f:3d:cd:c5:5a -o ! eth1 -j DROP
ebtables -A OUTPUT -p ARP --arp-ip-src 192.168.0.110 -o ! eth1 -j DROP
ebtables -t nat -A PREROUTING -p arp -i eth1 --arp-opcode Request -j
arpreply --arpreply-mac 00:0f:3d:cd:c5:5a --arpreply-target ACCEPT

ebtables -t nat -A PREROUTING -p arp -i eth0 --arp-opcode Request -j
arpreply --arpreply-mac 00:30:f1:25:fc:52 --arpreply-target ACCEPT
------------------------------------------------------------------------------------

My IPTables ruleset (minimal) looks as follows:

-----------------------------------------------------------------------------
service syslog restart

/sbin/iptables -F
/sbin/iptables -X
/sbin/iptables -Z

/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT

/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A INPUT -d 225.0.0.50 -j ACCEPT
/sbin/iptables -A OUTPUT -d 225.0.0.50 -j ACCEPT

/sbin/iptables -A FORWARD -i br0 -o br0 -s 192.168.10.0/24 -d
192.168.10.0/24 -p tcp -m state --state NEW,ESTABLISHED,RELATED -j
ACCEPT
/sbin/iptables -A FORWARD -j LOG --log-prefix ' *AF_I_VISHAM* ' --log-level 4
/sbin/iptables -A FORWARD -j DROP
------------------------------------------------------------------------------------


My IPTables log looks like this:
------------------------------------------------------------------------------------
Jul  7 03:45:20 localhost kernel: physdev match: using --physdev-out
in the OUTPUT, FORWARD and POSTROUTING chains for non-bridged traffic
is not supported anymore.
Jul  7 03:45:20 localhost last message repeated 977 times
Jul  7 03:45:43 localhost kernel:  *AF_I_VISHAM* IN=br0 OUT=br0
PHYSIN=eth0 SRC=192.168.10.2 DST=192.168.10.3 LEN=60 TOS=0x00
PREC=0x00 TTL=63 ID=6711 DF PROTO=TCP SPT=40736 DPT=5001 WINDOW=5840
RES=0x00 SYN URGP=0
Jul  7 03:45:52 localhost kernel:  *AF_I_VISHAM* IN=br0 OUT=br0
PHYSIN=eth0 SRC=192.168.10.2 DST=192.168.10.3 LEN=60 TOS=0x00
PREC=0x00 TTL=63 ID=6713 DF PROTO=TCP SPT=40736 DPT=5001 WINDOW=5840
RES=0x00 SYN URGP=0
------------------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08