You appear to be missing a masquerade in the routers POSTROUTING table!
This is a very simplified version of my own forwarding rules on my ASUS EEEPC acting as router for my wired and wireless networks. I won't guarantee that this will work, because I edited it online here, but I hope it helps. A perfect set of rules is a very complicated and individual thing! My iptables contains about 25000 variable rules, mainly to stop spam on port 25 from unwanted countries during peak periods.
There are loads more rules that you should add to keep traffic down to only that which is necessary. Block outgoing traffic too, such as broadcasts, dhcp, mDNS etc. mDNS on port 5353 is a big offender there. Running tcpdump on an ISP's internal network makes you wonder how on Earth any real traffic has space to move!
I added a rule to stop irritating ssh brute attacks too... :-)
Add a rule for your home ip address to override all others in case you saw off the branch you're sitting on, but when making changes, better to try a timed test and fallback to a working config after 5 seconds, eg:
# ./testfirewall.sh; sleep 10;./firewall.sh
Oh the router:
#!/bin/sh
IPT=/usr/sbin/iptables;
EXTIF=eth0;
INTIF=eth1;
EXTADDR=56.X.X.X;
NODEADDR=10.182.33.191;
HI_PORTS=1024:65535
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -t filter -P FORWARD DROP
# useful limit ssh attempts
$IPT -N SSH_Brute_Force
$IPT -A SSH_Brute_Force -m recent ! --rcheck --seconds 60 --hitcount 2 --rttl --name SSH -j RETURN
$IPT -A SSH_Brute_Force -j LOG --log-prefix "SSH Scan Reject: "
$IPT -A SSH_Brute_Force -j DROP
# dnat
$IPT -t nat -A PREROUTING -i $EXTIF -p tcp -d $EXTADDR --sport $HI_PORTS --dport 80 -j DNAT --to-destination $NODEADDR:80
# forward only established connections
$IPT -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# antispoof
$IPT -t filter -A FORWARD -i $EXTIF -s $EXTADDR -j DROP
$IPT -t filter -A FORWARD -i $EXTIF -s 127.0.0.1 -j DROP
# forward new connections to node1 on port 80
$IPT -t filter -A FORWARD -i $EXTIF -o $INTIF -p tcp -d $NODEADDR -m state --state NEW --sport $HI_PORTS --dport 80 -j ACCEPT
# forward all outgoing connections from node1 (need more rules to prevent broadcasts/leakage/bogons/igmp/some icmps etc in and out)
$IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# this appeared to be missing
$IPT -t nat -A POSTROUTING -o $EXTIF -s $NODEADDR -d 0/0 -j MASQUERADE
$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --dport 22 -m recent --set --name SSH -j SSH_Brute_Force
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 22 -j ACCEPT
#need to add this if you are sending mail
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset
On the node, inputs should already be clean:
#!/bin/sh
IPT=/usr/sbin/iptables;
EXTIF=eth0;
INTIF=eth1;
EXTADDR=56.X.X.X;
NODEADDR=10.182.33.191;
HI_PORTS=1024:65535
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -t filter -P FORWARD DROP
# useful limit ssh attempts
$IPT -N SSH_Brute_Force
$IPT -A SSH_Brute_Force -m recent ! --rcheck --seconds 60 --hitcount 2 --rttl --name SSH -j RETURN
$IPT -A SSH_Brute_Force -j LOG --log-prefix "SSH Scan Reject: "
$IPT -A SSH_Brute_Force -j DROP
$IPT -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -t filter -A INPUT -i lo -j ACCEPT
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 80 -j ACCEPT
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --dport 22 -m recent --set --name SSH -j SSH_Brute_Force
$IPT -t filter -A INPUT -i $EXTIF -p tcp -m state --state NEW -m tcp -d $NODEADDR --sport $HI_PORTS --dport 22 -j ACCEPT
end