terminal services and iptables

for terminal services to work behind an iptables firewall, if the terminal server does not have a valid IP address, a full cone nat is required, which in iptables terms means that you need both a PREROUTING and a POSTROUTING statement.