[CentOS] vsFTP and shorewall

 Dear all, 


Dear support and users:
   Sorry to trouble you! I configure the shorewall firewall to forward ftp and ssh port to another server, but failed. Can you help me check?
   I cannot login both SSH 2222 and ftp!
   Below is my environment:  (attachment is shorewall dump)  


1. Gateway (FC6)  
  1.1) eth0:  lan static IP:  192.168.1.20
  1.2) eth1:  external public static IP:  113.89.142.80
  2.3) Shorewall-3.2.8 is running


2. FTP Server: (Centos63, iptables and selinux are off) 
  2.1) eth0:  lan static IP: 192.168.1.231
  2.2) Open SSH port 22 and FTP port 20, 21 already (tested)
  2.3) vsftp.conf : use default settings  and it works for internal users


3. I want to forward internet access FTP and SSH to FTP Server:
     3.1)  113.89.142.80: 20   -> 192.168.1.231:20  udp    (FTP)
     3.2)  113.89.142.80: 21   -> 192.168.1.231:21  tcp     (FTP)
     3.3)  113.89.142.80: 2222   -> 192.168.1.231:22  tcp  (SSH)


4. Shorewall settings:
    4.1 interfaces
              #ZONE   INTERFACE       BROADCAST       OPTIONS
              net     eth1             113.89.142.255 norfc1918,arp_filte
              lan     eth0            detect          arp_filter
              ovpn    tun0            -
             #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
   4.2 zones
           #ZONE   TYPE            OPTIONS         IN                      OUT
          #                                       OPTIONS                 OPTIONS
          fw      firewall
          net     ipv4
          lan     ipv4
           ovpn    ipv4
         #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
   4.3 policy
            #SOURCE         DEST            POLICY          LOG             LIMIT:BURST
            #                                               LEVEL
            fw              all             ACCEPT
            lan             net             ACCEPT
            lan             fw              ACCEPT
            lan             ovpn            ACCEPT
            ovpn            lan             ACCEPT
            net             all             DROP
            all             all             REJECT
            #LAST LINE -- DO NOT REMOVE
    4.4 rules
            #SECTION RELATED
SECTION NEW
ACCEPT  all     fw      tcp     ftp               <<< it works for local FTP service (tested)
ACCEPT  all     fw      udp     ftp              <<< it works for local FTP service
ACCEPT  all     fw      tcp     2222
ACCEPT  all     fw      tcp     ssh,domain
Ping/ACCEPT     net     fw
ACCEPT  all     fw      tcp     5222
ACCEPT  all     fw      udp     5222
ACCEPT:info     all     $FW     tcp     22
DNAT    net     lan:192.168.1.231      tcp     21
DNAT    net     lan:192.168.1.231       udp    20
DNAT    net     lan:192.168.1.231:22       tcp     2222
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE


  5. # cat /proc/sys/net/ipv4/ip_forward
      1


  6. more /etc/sysconfig/iptables-config
      IPTABLES_MODULES="ip_conntrack_netbios_ns ip_nat_ftp ip_conntrack_ftp"


Chain net_dnat (1 references)
 pkts bytes target     prot opt in     out     source               destination
    3   156 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:21 to:192.168.1.231
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:20 to:192.168.1.231
    5   260 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:2222 to:192.168.1.231:22


do you know what's wrong?


Thanks and best regards!
Muiz