What is wrong with these iptables rules?

Question

I have a simple iptables setup that isn't quite right, and I'd love to know why it works this way and what I can do to get this working. Here are my rules:

# redirect 80 to site
sudo iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to 8080

sudo iptables -A INPUT -s 127.0.0.1 -j ACCEPT # local is good
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT # stuff from me is good 
sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT # ssh is good
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT # and so is web
sudo iptables -A INPUT -j DROP # culprit?

So the port forwarding from 80 to 8080 is cool, until I add the last DROP rule. When I do I get timeouts on the request. Is there something I have to chain to get the drop and the prerouting to work together, or is the mistake something else? Thanks for your help.

Answer 1

Most helpful tool concerning iptables EVER:

http://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg

See that -t nat -A PREROUTING gets applied to the packet before it reaches the INPUT chain. So, ACCEPT --dport 8080 instead of --dport 80.