Thank you all for you help with iptables. 
Now a new question. 
If you want to do port forwarding do you have to accept it on the INPUT chain?? 
So in syntax I think what I'm asking is this
if I do 
iptables -A FORWARD -p tcp -i $ext -dport 8081 -j ACCEPT
iptables -t nat -A PREROUTING -s $FIREWALL -dport 8081 -j DNAT --to $WEBSERVER:80

(syntax may be a little off I'm trying to do this "on the fly")

do I need to add this to the rules?

iptables -A INPUT -p tcp -dport 8081 -j ACCEPT

So far I've tried both and haven't gotten it to work but while debugging <??> I thought I would find out how it *should* be working. 

Thanks,