[ml] Problema con Iptables

Prima di tutto vorrei sapere se con questo script la macchina si può 
ritenere sicura, da premettere che eth1 ha un ip pubblico e eth0 ha un 
ip 192.168...
In più vorrei fare una NAT su un'altra macchina in rete LAN
Con questo scrit vorrei che dall'esterno si raggiunge solo 192.168.0.3 
sulla porta 143 e nessun'altra macchina e/o porta.
Grazie mille....
Michele

#!/bin/bash
LAN=eth0
INET=eth1

modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "1" > /proc/sys/net/ipv4/conf/all/log_martians

iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

# LOGGIN GENERAL
iptables -I INPUT -p icmp --icmp-type echo-request -j ULOG 
--ulog-nlgroup 1 --ulog-prefix "ICMP_DROP: "
iptables -I INPUT -m state --state INVALID -j ULOG --ulog-nlgroup 1 
--ulog-prefix "INVALID: "
iptables -I INPUT -p tcp ! --syn -m state --state NEW -j ULOG 
--ulog-nlgroup 1 --ulog-prefix "NEW_INCORRECT: "

# INPUT
# LOCALHOST
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT          -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $INET -m state --state NEW -p tcp -j ACCEPT
iptables -A INPUT -i $LAN  -m state --state NEW -j ACCEPT
iptables -A INPUT -i $INET -p tcp --dport ssh -j ULOG --ulog-nlgroup 1 
--ulog-prefix="SSH: "
iptables -A INPUT          -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -i $LAN  -p tcp --sport domain -j ACCEPT
iptables -A INPUT          -p icmp -j ACCEPT
iptables -A INPUT          -p tcp --dport 80 -j ACCEPT
iptables -A INPUT          -p tcp --dport 81 -j ACCEPT
iptables -A INPUT -i $INET -p tcp --dport 9898 -j ULOG --ulog-nlgroup 1 
--ulog-prefix="WEBMIN: "
iptables -A INPUT          -p tcp --dport 9898 -j ACCEPT
iptables -A INPUT          -p tcp -m tcp --sport 1024:65535 --dport 
20:21 -m state --state NEW -j ACCEPT
iptables -A INPUT -i $INET -p tcp --dport 1220 -j ULOG --ulog-nlgroup 1 
--ulog-prefix="DARWIN: "
iptables -A INPUT          -p tcp --dport 1220 -j ACCEPT
iptables -A INPUT          -p tcp --dport 554 -j ACCEPT
iptables -A INPUT          -p udp --dport 1024:65533 -j ACCEPT
iptables -A INPUT          -p tcp --dport 143 -j ACCEPT

# FORWARD
iptables -A FORWARD -i $INET -o $LAN -m state --state 
ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $LAN -m state --state NEW -j ACCEPT
iptables -A FORWARD -i $LAN -o $INET -j ACCEPT

# NAT
iptables -t nat -A PREROUTING -p tcp -d 80.XXX.XXX.XXX --dport 143 -j 
DNAT --to 192.168.0.3
iptables -t nat -A POSTROUTING -s 192.168.0.3 -j SNAT --to 80.XXX.XXX.XXX