iptables forwarding between subnets

Question

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though intuitively they seem like they should work.

These are the rules I've tried, I've also tried them without destination and source addresses...

Chain INPUT (policy DROP 76 packets, 6424 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   52  6866 ACCEPT     all  --  lo     any     anywhere             anywhere            
 1117 92168 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED 
    1   152 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy DROP 24 packets, 1812 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth0   eth0:0  anywhere             184.107.60.0/24     
    0     0 ACCEPT     all  --  eth0:0 eth0    184.107.60.0/24      anywhere            

Chain OUTPUT (policy ACCEPT 95 packets, 9660 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain sshguard (0 references)
 pkts bytes target     prot opt in     out     source               destination

Just for good measure here is my ifconfig...

eth0      Link encap:Ethernet  HWaddr 00:25:90:25:61:41  
          inet addr:174.142.61.201  Bcast:174.142.61.223  Mask:255.255.255.224
          inet6 addr: fe80::225:90ff:fe25:6141/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:205399 errors:0 dropped:0 overruns:0 frame:0
          TX packets:105545 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:251555745 (239.9 MiB)  TX bytes:34853743 (33.2 MiB)
          Interrupt:16 Memory:d0180000-d01a0000 

eth0:0    Link encap:Ethernet  HWaddr 00:25:90:25:61:41  
          inet addr:184.107.60.176  Bcast:184.107.60.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:16 Memory:d0180000-d01a0000 

I've tried this with different rules that don't specify interfaces and still nothing gets through when iptables is enabled.

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  184.107.60.0/24      anywhere            
ACCEPT     all  --  anywhere             184.107.60.0/24     

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain sshguard (0 references)
target     prot opt source               destination         
DROP       all  --  email.globaltravelerusa.com  anywhere

The rules run on a dedicated server which has its adapter bridged with virtual machines. I need to forward packets between the alias and the main physical interface, because the other IP addresses I am given are on another subnet. The rules currently work if I just have a forward allow policy. Technically that has fixed the problem, but in accepting that solution I learn nothing about what I do with iptables. Obviously IP forwarding is on, and I can access the server from my home computer in another country with iptables configured to allow all forwarding.

The problem is simple: what are the right rules to use for forwarding between subnets? The ones shown do not work, for some reason.

This is working...

Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain sshguard (0 references)
target     prot opt source               destination         
DROP       all  --  1.93.29.150          anywhere            
DROP       all  --  42.96.131.14         anywhere            
DROP       all  --  42.62.3.18           anywhere

Answer 1

Avoid eth0:0 in Netfilter rules, use eth0 only (if you need it at all).

See: Why doesn't my iptables rule work?

Answer 2

I am not certain you can route between alias of interfaces, but I am assuming you can for now;

The rule sets you are showing in the question are not complete as they do not show the interfaces involved. Rather than iptables -L, please provide the output of iptables -L -v -n to ensure that all the rule set is displayed completely.

To help you debug the situation, seeing as your 2nd iptables rule set is allowing your forwarding and the only difference that I can see is FORWARD's policy being set to ACCEPT you can add a LOG rule at the end of the 1st rule set to see which traffic is being dropped in the FORWARD chain. Like so:

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  184.107.60.0/24      anywhere            
ACCEPT     all  --  anywhere             184.107.60.0/24    

# iptables -A FORWARD -j LOG --log-prefix "dropped_by_fwd_policy "

Then you can see on your kernel log which packets are being dropped and from there you may be able to figure out why that is happening.