R's iptables config for ssh natting

Struggled a bit with R to configure his machine to nat ssh - here's a working /etc/sysconfig/iptables for Fedora -

# Generated by iptables-save v1.2.11 on Sat Mar 11 13:08:36 2006
*filter
:INPUT DROP [1339:140723]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [137:35130]
# allow local loopback connections
-A INPUT -i lo -j ACCEPT
# drop INVALID connections
-A INPUT   -m state --state INVALID -j DROP
-A OUTPUT  -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
# accept requests from internal machines on port 8080
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -p tcp -m tcp --dport 8080 -j ACCEPT 
-A FORWARD -s 192.168.0.0/255.255.255.0 -i eth0 -p tcp -m tcp --dport 80 -j REJECT
-A FORWARD -s 192.168.0.0/255.255.255.0 -i eth0 -p tcp -m tcp --dport 443 -j REJECT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -d 202.141.1.132 -o eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A OUTPUT -d 202.41.99.9 -o eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT 
-A OUTPUT -o eth0 -p tcp -m state --state NEW -m tcp --dport 110 -j ACCEPT 
COMMIT
# Completed on Sat Mar 11 13:08:36 2006
# Generated by iptables-save v1.2.11 on Sat Mar 11 13:08:36 2006
*nat
:PREROUTING ACCEPT [128:15724]
:POSTROUTING ACCEPT [35:2100]
:OUTPUT ACCEPT [35:2100]
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE
COMMIT
# Completed on Sat Mar 11 13:08:36 2006

By changing the ports to REJECT in the format --dport 8081:65535 he can block access to any other service.

We took more than an hour, because default routes were not set to use this machine as a gateway, and also the machine blocks pings. Once the gateway was set correctly on his double-homed Win2k3 box, it worked. But we also struggled a bit because of forgetting the two COMMITs, one after each *table. Also, the

echo "1" > /proc/sys/net/ipv4/ip_forward

was getting overwritten on service network restart, he had to add it to the startup scripts.