День добрый!
не ругайте, прочитал все что нашел в форуме по настройке iptables и проброса  портов, но ничего не получилось...
задача предоставить доступ на терминальный сервер внутри сети с инета.. на роутере  стоит debian
прочитав "Руководства по iptables (Iptables Tutorial 1.1.19)" и взяв за основу rc.firewall с него же, получил такой скрипт:

    INET_IP="192.168.1.2"
    INET_IFACE="eth1"
    INET_BROADCAST="192.168.1.255"
    
    LAN_IP="192.168.0.81"
    LAN_IP_RANGE="192.168.0.0/24"
    LAN_IFACE="eth0"
    
    LO_IFACE="lo"
    LO_IP="127.0.0.1"

    IP_ADR="192.168.0.132 192.168.0.191"
    
    IPTABLES="/sbin/iptables"
    
    $IPTABLES -F
    $IPTABLES -t nat -F
    $IPTABLES -X
    $IPTABLES -t nat -X
    
    /sbin/depmod -a
    /sbin/modprobe ip_tables
    /sbin/modprobe ip_conntrack
    /sbin/modprobe iptable_filter
    /sbin/modprobe iptable_mangle
    /sbin/modprobe iptable_nat
    /sbin/modprobe ipt_LOG
    /sbin/modprobe ipt_limit
    /sbin/modprobe ipt_state
    /sbin/modprobe ipt_REJECT
    #/sbin/modprobe ip_conntrack_ftp
    #/sbin/modprobe ip_nat_ftp

    $IPTABLES -P INPUT DROP
    $IPTABLES -P OUTPUT DROP
    $IPTABLES -P FORWARD DROP
    
    $IPTABLES -N bad_tcp_packets
    $IPTABLES -N allowed
    $IPTABLES -N tcp_packets
    $IPTABLES -N udp_packets
    $IPTABLES -N icmp_packets
    
    $IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
    $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
    $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
    
    $IPTABLES -A allowed -p TCP --syn -j ACCEPT
    $IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -A allowed -p TCP -j DROP
    
    #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 3389 -j allowed
    
    $IPTABLES -A udp_packets -p UDP -s 0/0 --destination-port 123 -j ACCEPT
    $IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP  
    $IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP          

    $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
    $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
    
    $IPTABLES -A INPUT -p tcp -j bad_tcp_packets
    $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
    $IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
    $IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
    $IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
    $IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
    $IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
    $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
    $IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
    $IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
    $IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "
    
    $IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
    for i in $IP_ADR
    do
    #$IPTABLES -A FORWARD -p tcp --dport 21 -i $LAN_IFACE -s $i -j ACCEPT
    #$IPTABLES -A FORWARD -p tcp --dport 80 -i $LAN_IFACE -j ACCEPT #что бы через прокси ходили
    $IPTABLES -A FORWARD -p tcp --dport 995 -i $LAN_IFACE -s $i -j ACCEPT  
    $IPTABLES -A FORWARD -p tcp --dport 110 -i $LAN_IFACE -s $i -j ACCEPT
    $IPTABLES -A FORWARD -p tcp --dport 25 -i $LAN_IFACE -s $i -j ACCEPT
    done
    $IPTABLES -A FORWARD -p udp --dport 53 -i $LAN_IFACE -j ACCEPT
    $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
    
    $IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
    
    $IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
    $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
    $IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
    $IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

    $IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP
    echo "1" > /proc/sys/net/ipv4/ip_forward

для проброса порта добавляю следующие правила:
$IPTABLES -t nat -A PREROUTING -d $INET_IP -s X.X.X.X -p tcp -m tcp --dport 3389 -j DNAT --to-destination $192.168.0.100:3389
$IPTABLES -t nat -A POSTROUTING -d $192.168.0.100 -p tcp -m tcp --dport 3389 -j SNAT --to-source $INET_IP
$IPTABLES -A FORWARD -d $192.168.0.100 -p tcp -m tcp --dport 3389 -m state --state NEW -j ACCEPT

router:/etc/init.d# iptables-save
# Generated by iptables-save v1.3.6 on Tue Dec 23 16:09:44 2008
*mangle
:PREROUTING ACCEPT [367658:176117167]
:INPUT ACCEPT [212949:33807366]
:FORWARD ACCEPT [154391:142244413]
:OUTPUT ACCEPT [198441:21735236]
:POSTROUTING ACCEPT [347980:163677267]
COMMIT
# Completed on Tue Dec 23 16:09:44 2008
# Generated by iptables-save v1.3.6 on Tue Dec 23 16:09:44 2008
*nat
:PREROUTING ACCEPT [5664:677274]
:POSTROUTING ACCEPT [91:11582]
:OUTPUT ACCEPT [3061:198654]
-A PREROUTING -s 192.168.1.132 -d 192.168.1.2 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.100:3389
-A POSTROUTING -d 192.168.0.100 -p tcp -m tcp --dport 3389 -j SNAT --to-source 192.168.1.2
-A POSTROUTING -o eth1 -j SNAT --to-source 192.168.1.2
COMMIT
# Completed on Tue Dec 23 16:09:44 2008
# Generated by iptables-save v1.3.6 on Tue Dec 23 16:09:44 2008
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [241:15324]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.0.81 -i lo -j ACCEPT
-A INPUT -s 192.168.1.2 -i lo -j ACCEPT
-A INPUT -d 192.168.1.2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_packets
-A INPUT -i eth1 -p udp -j udp_packets
-A INPUT -i eth1 -p icmp -j icmp_packets
-A INPUT -d 224.0.0.0/255.0.0.0 -i eth1 -j DROP
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 7
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -d 192.168.0.100 -p tcp -m tcp --dport 3389 -m state --state NEW -j ACCEPT
-A FORWARD -s 192.168.0.132 -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -s 192.168.0.132 -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.0.132 -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 192.168.0.191 -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT
-A FORWARD -s 192.168.0.191 -i eth0 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.0.191 -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT FORWARD packet died: " --log-level 7
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.0.81 -j ACCEPT
-A OUTPUT -s 192.168.1.2 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died: " --log-level 7
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn:"
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A udp_packets -p udp -m udp --dport 123 -j ACCEPT
-A udp_packets -d 192.168.1.255 -i eth1 -p udp -m udp --dport 135:139 -j DROP
-A udp_packets -d 255.255.255.255 -i eth1 -p udp -m udp --dport 67:68 -j DROP
COMMIT
# Completed on Tue Dec 23 16:09:44 2008

подключиться не удается, tcpdump выдает:
IP 192.168.1.132.2397 > 192.168.1.2.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.1.2.2397 > 192.168.0.100.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.0.100.3389 > 192.168.1.2.2397: S 424898435:424898435(0) ack 2112752088 win 17520 <mss 1460>
IP 192.168.0.100.3389 > 192.168.1.2.2397: S 424898435:424898435(0) ack 2112752088 win 17520 <mss 1460>
IP 192.168.1.132.2397 > 192.168.1.2.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.1.2.2397 > 192.168.0.100.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.0.100.3389 > 192.168.1.2.2397: . ack 1 win 17520                                                                                  
IP 192.168.0.100.3389 > 192.168.1.2.2397: S 424898435:424898435(0) ack 2112752088 win 17520 <mss 1460>
IP 192.168.1.132.2397 > 192.168.1.2.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.1.2.2397 > 192.168.0.100.3389: S 2112752087:2112752087(0) win 8760 <mss 1460>                          
IP 192.168.0.100.3389 > 192.168.1.2.2397: . ack 1 win 17520    

а если пишу так:
    $IPTABLES -t nat -A POSTROUTING -d $192.168.0.100 -o $INET_IFACE -p tcp -m tcp --dport 3389 -j SNAT --to-source $INET_IP        
снова подключение не происходит, а tcpdump выдает:
IP 192.168.1.132.2403 > 192.168.1.2.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                                  
IP 192.168.1.132.2403 > 192.168.0.100.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                              
IP 192.168.0.100.3389 > 192.168.1.132.2403: S 2492537059:2492537059(0) ack 1215192329 win 17520 <mss 1460>
IP 192.168.0.100.3389 > 192.168.1.132.2403: S 2492537059:2492537059(0) ack 1215192329 win 17520 <mss 1460>
IP 192.168.1.132.2403 > 192.168.1.2.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                                  
IP 192.168.1.132.2403 > 192.168.0.100.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                              
IP 192.168.0.100.3389 > 192.168.1.132.2403: . ack 1 win 17520                                                                                      
IP 192.168.1.132.2403 > 192.168.1.2.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                                  
IP 192.168.1.132.2403 > 192.168.0.100.3389: S 1215192328:1215192328(0) win 8760 <mss 1460>                              
IP 192.168.0.100.3389 > 192.168.1.132.2403: . ack 1 win 17520                                                                                      
IP 192.168.0.100.3389 > 192.168.1.132.2403: S 2492537059:2492537059(0) ack 1215192329 win 17520 <mss 1460>                

понимаю что упустил где-то что-то, но вот где и что никак не соображу...
решил даже было плюнуть на все и воспользоваться simpleproxy, но если я подключаюсь по внутреннему IP (192.168.0.81), проброс на 192.168.0.100 происходит, если на внешний (192.168.1.2) - никак не хочет...