【求助】用iptables做ssh端口转发一直不成功

[why6661991]

公网服务器
公网ip:210.32.xx.xx
内网ip:192.168.1.11

要ssh上的服务器
内网ip:192.168.148.144

要实现内网的ssh端口映射，外网通过能够ssh上内网的服务器，开个6020端口映射到内网服务器上的22端口。
下面是我的iptables表，一直不能ssh上，失败
*nat
:PREROUTING ACCEPT [67:3696]
:POSTROUTING ACCEPT [59:3951]
:OUTPUT ACCEPT [59:3951]
-A PREROUTING -d 210.32.xx.xx/32 -p tcp -m tcp --dport 6020 -j DNAT --to-destination 192.168.148.144:22
-A POSTROUTING -d 192.168.148.144 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.1.11
-A POSTROUTING -o eth0 -s 192.168.1.0/24 -j MASQUERADE
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [83:19984]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6030 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 6020 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -d 192.168.1.11/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.1.11/32 -p tcp -m tcp --sport 22 -j ACCEPT
-A FORWARD -d 192.168.148.144 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.148.144 -p tcp -m tcp --sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

希望高手解答一下

[linkscue]

内网PC执行： # username@localhost port:22 <-- --> [e-mail] port:9103 ssh -l username -N -f -R 9103:localhost:22 [e-mail] 外网PC执行： # 以username身份登录端口9103的 ssh -l username -p 9103 localhost

[RedHat-小怪兽]

iptables -t nat -I PREROUTING -d 210.32.xx.xx -p tcp --dport 6020 -j DNAT --to 192.168.1.11:22 iptables -t nat -I POSTROUTING -d 192.168.1.11 -p --dport 22 -j SNAT --to 210.21.xx.xx

[GrubLinux]

是不是IP_FORWARD没开？ echo 1 > /proc/sys/net/ipv4/ip_forward试试

[nfme]

iptables -A FORWARD -p tcp --dport 6030 -j ACCEPT

[Ghostbaby]

linux:~ # cat iptables.save 
# Generated by iptables-save v1.4.6 on Thu Feb 13 15:28:47 2014
*nat
:PREROUTING ACCEPT [4942:284273]
:POSTROUTING ACCEPT [123:7428]
:OUTPUT ACCEPT [123:7428]
-A PREROUTING -d 218.94.153.182/32 -p tcp -m tcp --dport 6081 -j DNAT --to-destination 10.10.3.10:6081 
-A POSTROUTING -d 10.10.3.10/32 -p tcp -m tcp --dport 6081 -j SNAT --to-source 10.10.3.215 
-A POSTROUTING -s 10.10.3.0/24 -o eth0 -j SNAT --to-source 218.94.153.182 
COMMIT 
# Completed on Thu Feb 13 15:28:47 2014
# Generated by iptables-save v1.4.6 on Thu Feb 13 15:28:47 2014
*filter
:INPUT ACCEPT [231453:14196913]
:FORWARD ACCEPT [92:5660]
:OUTPUT ACCEPT [10168522:5353705179]
-A INPUT -s 10.10.3.0/24 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -s 218.94.153.180/32 -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j DROP  
-A FORWARD -d 10.10.3.10/32 -o eth0 -p tcp -m tcp --dport 6081 -j ACCEPT 
-A FORWARD -s 10.10.3.10/32 -i eth0 -p tcp -m tcp --sport 6081 -j ACCEPT  
COMMIT
# Completed on Thu Feb 13 15:28:47 2014

[杭州山不高]

现在解决了没啊？