what did you mean rcfirewall stop?
Is this a script ? my stop script closes the box.
You might try flushing all the rules and resetting them to the default ACCEPT , then logging EVERYTHING and see what the logs say
Does "iptables -V " show you FOWARDING is being dropped?
what does your routing table look like?

Oh, and don't forget
# Dynamic IP users: SLIP, PPP, or DHCP leave this enabled
echo "1" > /proc/sys/net/ipv4/ip_dynaddr