我一直在努力解决一个FORWARD无法按我想要的方式运行的策略，我无法弄清楚是什么导致会话失败。我希望有人能帮忙。
我的目标是将端口 3000 从 eth0 转发到内部 Windows 机器端口 3389，从 eth2 转发出去，这样我就可以通过 RDP 进入 Windows 机器。下面的配置脚本仅适用于iptables -P FORWARD ACCEPT，但我并不想这样。我觉得 更好iptables -P FORWARD DROP，但这对我来说不起作用。
这是我一直在使用的脚本的最新版本。请注意，这是包含我所有注释内容的完整脚本，因此您可以检查此处发生的一切，但请记住这是FORWARD我需要帮助的部分。
echo "Flush firewall and setting default chain policies..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
#iptables --append FORWARD -p tcp --dport 3000 -d 192.168.1.2 -j ACCEPT
echo "Enabling firewall with new ruleset..."
# allow ssh to eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# allow http-https traffic
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
# allow ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -t raw -A OUTPUT -p icmp -j TRACE
# full loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# minimize http-https DOS attack by limiting burst connections
# may need to adjust this later once web traffic is coming in
iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
# all rdp 3000 to jump box
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 3000 -j LOG --log-prefix "iptables-prerouting: " --log-level 7
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 3000 -j DNAT --to 192.168.1.2:3389
#iptables -A FORWARD -i eth0 -p tcp --dport 3389 -d 192.168.1.2 -j ACCEPT
#iptables -t raw -A PREROUTING -p tcp --dport 3389 -j TRACE
#iptables -t raw -A OUTPUT -p tcp --dport 3389 -j TRACE
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED -d 192.168.1.2 -p tcp --dport 3389 -j LOG --log-prefix "iptables-forward: " --log-level 7
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT
# nat internal network to public interface
iptables -A POSTROUTING -o eth0 -t nat -j LOG --log-prefix "iptables-postrouting: " --log-level 7
iptables -A POSTROUTING -o eth0 -t nat -j MASQUERADE
# logging
#iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables-input: " --log-level 7
iptables -A FORWARD -j LOG --log-prefix "iptables-forward: " --log-level 7
#iptables -A OUTPUT -j LOG --log-prefix "iptables-output: " --log-level 7
# enable ipv4 forwardning for the system
echo 1 > /proc/sys/net/ipv4/ip_forward
# add route for private network internet access
ip route add 192.168.1.0/24 proto kernel scope link dev eth2
#List iptables ruleset
echo "-----------------------------------------------------------------------------"
echo "Listing iptables..."
iptables -L
echo "-----------------------------------------------------------------------------"
echo "Listing ip routes..."
ip route
我已经跟踪了连接、启用了日志记录规则等，但无法根据提供的信息确定问题所在。我可以发现iptables -P FORWARD默认操作之间的跟踪差异，但仍然无法找到大海捞针。
我将非常感激您能给我的任何指点。谢谢！
感谢@HaukeLaging，我让它运行良好。这是最终的脚本。
echo "Flush firewall and setting default chain policies..."
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables --append INPUT -t filter -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables --append FORWARD -t filter -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables --append OUTPUT -t filter -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
echo "Enabling firewall with new ruleset..."
# allow ssh to eth0
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
# allow http-https traffic
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
# ----from private network
iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth0 -p tcp --dport 443 -j ACCEPT
# allow ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# ----from private network
iptables -A FORWARD -i eth2 -o eth0 -p icmp --icmp-type echo-request -j ACCEPT
# full loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# minimize http-https DOS attack by limiting burst connections
# may need to adjust this later once web traffic is coming in
iptables -A INPUT -p tcp --dport 80 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m limit --limit 10/minute --limit-burst 20 -j ACCEPT
# rdp 3000 to jump box
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 3000 -j DNAT --to 192.168.1.2:3389
iptables -A FORWARD -i eth0 -p tcp --dport 3389 -d 192.168.1.2 -j ACCEPT
# nat on public interface
iptables -A POSTROUTING -o eth0 -t nat -j MASQUERADE
# logging
#iptables -A INPUT -m limit --limit 2/min -j LOG --log-prefix "iptables-input: " --log-level 7
#iptables -A FORWARD -j LOG --log-prefix "iptables-forward: " --log-level 7
#iptables -A OUTPUT -j LOG --log-prefix "iptables-output: " --log-level 7
# enable ipv4 forwardning for the system
echo 1 > /proc/sys/net/ipv4/ip_forward
# add route for private > public access
ip route add 192.168.1.0/24 proto kernel scope link dev eth2
#List iptables ruleset
echo "-----------------------------------------------------------------------------"
echo "Listing iptables..."
iptables -L
echo "-----------------------------------------------------------------------------"
echo "Listing ip routes..."
ip route
答案1
你必须激活你注释掉的规则
iptables -A FORWARD -i eth0 -p tcp --dport 3389 -d 192.168.1.2 -j ACCEPT
而且你必须纠正这一条（当然还有上面的日志记录规则）：
iptables -A FORWARD -t filter -o eth0 -m state --state NEW,ESTABLISHED -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT
那是错误的。eth0如果输出那么接口192.168.1.2就是源，而不是目标。但为什么允许状态NEW？最简单的方法是：
iptables -A FORWARD -t filter -m state --state ESTABLISHED,RELATED -j ACCEPT
这是一条通用规则。如果你想更接近你的连接定义：
iptables -A FORWARD -t filter -o eth0 -m state --state ESTABLISHED -s 192.168.1.2 -p tcp --sport 3389 -j ACCEPT
编辑1：
您可能需要一条规则来允许所有来自其他系统的连接：
iptables -A FORWARD -t filter -o eth0 -m state --state NEW -s 192.168.1.2 -j ACCEPT
顺便说一句，引用手册页：
“state”模块是“conntrack”的过时版本。
如果您不使用简短规则来允许所有已建立的流量，那么您还需要类似这样的内容：
iptables -A FORWARD -t filter -i eth0 -m conntrack --ctstate ESTABLISHED -d 192.168.1.2 -j ACCEPT