I can't get iptables port forwarding to work. I think I have it set up correctly on the gateway, but I'm now doubting if the target machine might be the problem. If I set up forwarding from machine A on the Internet to machine C on the lan, with machine B being the gateway, would machine C's firewall then have to allow connections from the ip of B, or of A or..?
This is depends on your firewall rules. If you are doing SNATing, then you need to allow this IP (NATed IP). If you are just forwarding the packet without doing SNAT, you need to allow the original sender IP.