### iptables -L -vx Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP tcp -- any any 192.168.100.0/24 anywhere tcp dpt:22 0 0 DROP all -- any any anywhere anywhere state INVALID 176 11413 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 0 0 DROP tcp -- any any anywhere anywhere tcp option=!2 flags:SYN/SYN 3 457 input_rule all -- any any anywhere anywhere 0 0 input_wan all -- ppp0 any anywhere anywhere 3 457 LAN_ACCEPT all -- any any anywhere anywhere 0 0 ACCEPT icmp -- any any anywhere anywhere 0 0 ACCEPT gre -- any any anywhere anywhere 0 0 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset 0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable Chain FORWARD (policy DROP 2 packets, 120 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- any any anywhere anywhere state INVALID 6 320 TCPMSS tcp -- any any anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU 555 56315 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 4 224 forwarding_rule all -- any any anywhere anywhere 2 120 forwarding_wan all -- ppp0 any anywhere anywhere 0 0 ACCEPT all -- br-lan br-lan anywhere anywhere 0 0 ACCEPT all -- br-lan ppp0 anywhere anywhere 2 104 ACCEPT all -- br-lan2 ppp0 anywhere anywhere Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 DROP all -- any any anywhere anywhere state INVALID 136 16982 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 1 72 output_rule all -- any any anywhere anywhere 1 72 ACCEPT all -- any any anywhere anywhere 0 0 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset 0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable Chain LAN_ACCEPT (1 references) pkts bytes target prot opt in out source destination 0 0 RETURN all -- ppp0 any anywhere anywhere 0 0 RETURN all -- eth0.1 any anywhere anywhere 3 457 ACCEPT all -- any any anywhere anywhere Chain forwarding_rule (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- ppp0 any anywhere 10.0.0.51 tcp dpt:22 0 0 ACCEPT udp -- ppp0 any anywhere 10.0.0.51 udp dpt:22 Chain forwarding_wan (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- any any anywhere 10.0.0.21 tcp dpt:22 0 0 ACCEPT udp -- any any anywhere 10.0.0.21 udp dpt:22 Chain input_rule (1 references) pkts bytes target prot opt in out source destination Chain input_wan (1 references) pkts bytes target prot opt in out source destination Chain output_rule (1 references) pkts bytes target prot opt in out source destination ### iptables -t nat -L -vx Chain PREROUTING (policy ACCEPT 18 packets, 4455 bytes) pkts bytes target prot opt in out source destination 5 272 NEW tcp -- any any anywhere anywhere state NEW 20 4575 prerouting_rule all -- any any anywhere anywhere 2 120 prerouting_wan all -- ppp0 any anywhere anywhere Chain POSTROUTING (policy ACCEPT 1 packets, 72 bytes) pkts bytes target prot opt in out source destination 5 300 postrouting_rule all -- any any anywhere anywhere 4 228 MASQUERADE all -- any ppp0 anywhere anywhere Chain OUTPUT (policy ACCEPT 1 packets, 72 bytes) pkts bytes target prot opt in out source destination Chain NEW (1 references) pkts bytes target prot opt in out source destination 5 272 RETURN all -- any any anywhere anywhere limit: avg 50/sec burst 100 0 0 DROP all -- any any anywhere anywhere Chain postrouting_rule (1 references) pkts bytes target prot opt in out source destination Chain prerouting_rule (1 references) pkts bytes target prot opt in out source destination 0 0 DNAT udp -- ppp0 any anywhere anywhere udp dpt:22 to:10.0.0.51 0 0 DNAT tcp -- ppp0 any anywhere anywhere tcp dpt:22 to:10.0.0.51 Chain prerouting_wan (1 references) pkts bytes target prot opt in out source destination 0 0 DNAT udp -- any any anywhere anywhere udp dpt:2222 to:10.0.0.21:22 2 120 DNAT tcp -- any any anywhere anywhere tcp dpt:2222 to:10.0.0.21:22