############### Chain INPUT (policy ACCEPT 251 packets, 386K bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 Chain FORWARD (policy ACCEPT 53 packets, 13127 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:443 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9100 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9030 8 320 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9020 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9010 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:443 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:22 17 899 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:25 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:993 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:143 0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000 0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED 0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable Chain OUTPUT (policy ACCEPT 401 packets, 769K bytes) pkts bytes target prot opt in out source destination Zeroing chain `INPUT' Zeroing chain `FORWARD' Zeroing chain `OUTPUT' ############### Chain PREROUTING (policy ACCEPT 4487 packets, 328K bytes) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:443 to:172.17.63.199:443 474 29028 DNAT tcp -- * * 0.0.0.0/0 1.2.3.183 tcp dpt:80 to:172.17.63.198:9000 70 4200 DNAT tcp -- * * 0.0.0.0/0 1.2.3.185 tcp dpt:9100 to:172.17.63.198:9100 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.188 tcp dpt:80 to:172.17.63.198:9030 22 1176 DNAT tcp -- * * 0.0.0.0/0 1.2.3.187 tcp dpt:80 to:172.17.63.198:9020 47 2660 DNAT tcp -- * * 0.0.0.0/0 1.2.3.185 tcp dpt:80 to:172.17.63.198:9010 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.184 tcp dpt:80 to:172.17.63.198:9000 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:443 to:172.17.63.199:443 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:80 to:172.17.63.199:80 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:33 to:172.17.63.199:22 390 19296 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:25 to:172.17.63.199:25 1 64 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:993 to:172.17.63.199:993 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:143 to:172.17.63.199:143 0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.183 tcp dpt:80 to:172.17.63.198:9000 Chain POSTROUTING (policy ACCEPT 1091 packets, 62512 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:443 to:1.2.3.189:443 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.183:80 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9100 to:1.2.3.185:9100 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9030 to:1.2.3.188:80 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9020 to:1.2.3.187:80 1 1442 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9010 to:1.2.3.185:80 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.184:80 1847 134K MASQUERADE all -- * * 172.17.63.0/24 !172.17.63.0/24 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:443 to:1.2.3.189:443 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:80 to:1.2.3.189:80 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:22 to:1.2.3.189:33 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:25 to:1.2.3.189:25 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:993 to:1.2.3.189:993 0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:143 to:1.2.3.189:143 0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.183:80 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24 Chain OUTPUT (policy ACCEPT 67 packets, 4888 bytes) pkts bytes target prot opt in out source destination Zeroing chain `PREROUTING' Zeroing chain `POSTROUTING' Zeroing chain `OUTPUT' ########### ip addr sh ccbr 4: ccbr: mtu 1500 qdisc noqueue state UNKNOWN link/ether 00:24:8c:bf:15:16 brd ff:ff:ff:ff:ff:ff inet 1.2.3.181/28 brd 1.2.3.191 scope global ccbr inet 1.2.3.183/28 scope global secondary ccbr inet 1.2.3.189/28 scope global secondary ccbr inet 1.2.3.188/28 scope global secondary ccbr inet 1.2.3.187/28 scope global secondary ccbr inet 1.2.3.185/28 scope global secondary ccbr inet 1.2.3.184/28 scope global secondary ccbr inet6 fe80::224:8cff:febf:1516/64 scope link valid_lft forever preferred_lft forever ########## ip ro 1.2.3.176/28 dev ccbr proto kernel scope link src 1.2.3.181 172.17.63.0/24 dev i17br proto kernel scope link src 172.17.63.99 192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.99 192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1 172.17.0.0/16 dev i17br proto kernel scope link src 172.17.63.250 192.168.0.0/16 via 192.168.10.61 dev eth0 default via 1.2.3.190 dev ccbr