[matteo85]

io pure l'ho fatto, ho messo questo in /etc/init.d/iptables

#!/bin/sh /etc/rc.common

START=19

start() {
        iptables-restore </etc/firewall.ipt
}

e dentro /etc/firewall.ipt

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i pppoe-wan -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.2
-A PREROUTING -i pppoe-wan -p tcp --dport 51413 -j DNAT --to-destination 192.168.1.20
-A PREROUTING -i pppoe-wan -p udp --dport 51413 -j DNAT --to-destination 192.168.1.20
-A PREROUTING -i pppoe-wan -p tcp -m multiport --dports 43000:43010 -j DNAT --to-destination 192.168.1.25
-A PREROUTING -i pppoe-wan -p udp -m multiport --dports 43000:43010 -j DNAT --to-destination 192.168.1.25
-A POSTROUTING -o pppoe-wan -j MASQUERADE
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A FORWARD -o pppoe-wan -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT

ovviamente ho tolto il pacchetto firewall