Solution to the problem of Rhel/centos 5 NAT forwarding without work

TL;DR If you find that the NAT forwarding rules for Rhel/centos 5 are not working, please use iptables-l-nv to check the contents of the FORWARD chain, if there is a direct go to Rh-firewall-1-input Rules, then you are likely to be in the same hole as we are. Try to open the target port in the Rh-firewall-1-input chain, and those rules should work.
The company's server for a variety of reasons to do a lot of iptables NAT rules, used to do port mapping. We find that some of the rules can work, others are not. But these rules are basically the same, except that the port and the forwarding destination IP are different.
Our rules are simple:

The code is as follows	Copy Code
-A Prerouting-p TCP--dport 443-j dnat--to 192.168.1.2:8443 -A postrouting-d 192.168.1.2-p tcp--dport 8443-j SNAT--to

is to forward the 443 port on one server (192.168.1.1) to 8443 on the other (192.168.1.2). But we found out it didn't work. But similar rules for other ports, such as 80 to 8080, are OK:

The code is as follows	Copy Code
-A Prerouting-p TCP--dport 80-j dnat--to 192.168.1.3:8080 -A postrouting-d 192.168.1.3-p tcp--dport 8080-j SNAT--to

All kinds of Google search did not find the answer, but only careful examination of the rules of Iptables, the results found a clue: our 8443 port is not open, and 8080 is open! The decisive attempt to turn 8443 also to open, sure enough.
But the question is, why does the INPUT rule affect NAT forwarding? According to Iptables work, only the destination address is the local package will pass through the INPUT chain, and the forwarding package will only pass through the FORWARD chain. Well, the answer is really simple, blame us for not looking carefully. The iptables of Rhel/centos 5 creates a chain called rh-firewall-1-input and transfers both INPUT and FORWARD to the chain.
 

The code is as follows	Copy Code
*filter : INPUT ACCEPT [0:0] : FORWARD ACCEPT [0:0] : OUTPUT ACCEPT [9,418,420:35,897,535,679] : Rh-firewall-1-input-[0:0] -A input-j Rh-firewall-1-input -a forward-j rh-firewall-1-input #FORWARD hung directly onto Rh-firewall-1-input. -A rh-firewall-1-input-i lo-j ACCEPT #...... Omit several rules -A rh-firewall-1-input-j REJECT--reject-with icmp-host-prohibited

This practice personally feel very pit dad, forwarding the guarantee so much do, let the goal to judge to don't ACCEPT good, you are honest FORWARD well. Sure enough, in the version after Rhel/centos 6, the Rh-firewall-1-input was killed.