My guess is that you have a MASQUERADE rule with no interface specified - so packets get the source address of the firewall whether they're going out or coming in?
Make sure you specify "-o eth0" or "-o ppp0" or whatever your external interface is called.
If not that, post your ruleset so we can have a further think...
Testcase, as simple as possible: pc has 10.44.252.2 fw has 10.44.252.1 on inside (vmnet2), 10.44.8.10 on outside (eth0).
On outside of fw there is a chain of routers; 10.44.8.1 => 192.168.44.1, which is again connected to both 192.168.1.11 and 192.168.2.11 which I'll use below.
masquerading or snat (tried both, no difference):
root@fw # iptables -t nat -A POSTROUTING -o eth0 -s 10.44.252.2 -j SNAT --to-source 10.44.8.10
No other iptables rules are defined yet.
simonl@pc $ traceroute -q1 -I 192.168.1.11 traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets 1 10.44.252.1 (10.44.252.1) 4.297 ms 2 10.44.8.1 (10.44.8.1) 3.892 ms 3 192.168.44.1 (192.168.44.1) 4.826 ms 4 192.168.1.11 (192.168.1.11) 5.095 ms
All good. Now for the fun (dnat to another host at similar distance):
root@fw # iptables -t nat -A PREROUTING -i vmnet2 -s 10.44.252.2 -d 192.168.1.11 -j DNAT --to-destination 192.168.2.11
simonl@pc $ traceroute -q1 -I 192.168.1.11 traceroute to 192.168.1.11 (192.168.1.11), 30 hops max, 38 byte packets 1 10.44.252.1 (10.44.252.1) 1.854 ms 2 192.168.1.11 (192.168.1.11) 9.378 ms 3 192.168.1.11 (192.168.1.11) 17.237 ms 4 192.168.1.11 (192.168.1.11) 3.783 ms
See?
I tried dnat'ing without snat on a real network, same problem. So snat/masquerade has no influence (it is just needed for my setup).
Simon
