iptables and virtual hosts problem

[Erik Persson <erik-maillist@djingis.se>]

Hello!

I have a server which is running 2 different virtual hosts (vserver), 
let's call them S for the server, A and B for the virtual hosts A and B.
S, A and B have different ip-addresses (say s.s.s.s, a.a.a.a and b.b.b.b).

Since the server isn't really forwarding anything I haven't used the 
FORWARD chain for anything, and I use INPUT and OUTPUT to regulate the 
flow to the different servers, for example:

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -I INPUT -d a.a.a.a -p tcp --dport 80 -j ACCEPT
on the server
seems to do what I want. In the example above letting A and only A 
answer requests on port 80.

However, when I try to regulate the flow of traffic between the 
different "machines" (S, A, and B) strange things happen.

For example:
iptables -I OUTPUT -d a.a.a.a -p tcp --dport 25 -j ACCEPT
doesn't only allow any of the "machines" to try to contact port 25 on A, 
but it *also allows A to answer* !!!

I would very much like to know why:
iptables -I INPUT [...] -d a.a.a.a -p tcp --dport 25 -j ACCEPT
isn't required.

Thanks in advance!

/erik