problem s ipchains - Policy FORWARD

Imam slednia problem s ipchains policy FORWARD:

Taka raboti:

Chain forward (policy MASQ):
target prot opt source destination ports
MASQ all ------ 10.12.1.0 anywhere n/a
MASQ all ------ 10.13.2.0 anywhere n/a
MASQ all ------ 10.14.3.0 anywhere n/a
MASQ all ------ 10.15.4.0 anywhere n/a

A taka ne raboti:

Chain forward (policy ACCEPT):
target prot opt source destination ports
MASQ all ------ 10.12.1.0 anywhere n/a
MASQ all ------ 10.13.2.0 anywhere n/a
MASQ all ------ 10.14.3.0 anywhere n/a
MASQ all ------ 10.15.4.0 anywhere n/a

Zashto se poluchawa taka. Server-a e na Debian.

Hubavo shteshe da byde, ako beshe napisal tuk i samite redove s ipchains. Po princip se pravi neshto ot roda na:
ipchains -P forward DENY
ipchains -A forward -s 10.12.1.0/24 -d 0/0 -i <ext.i-face> -j MASQ

Polycito na forward ne trjabva li da ti bude DENY?

Ne, nestawa s DENY, tribwa da bude ACCEPT poneje iskam da proklaram i 1 ip realen adres.

DENY e politikata, koiato se prilaga vyrhu paketa edva kogato e minal prez vsichki rules i ne e matchnal s nito edin ot tiah. Ti probva li izobshto s nego ili govorish naizust ?