*filter
:INPUT ACCEPT [25350:2120857]
:FORWARD ACCEPT [1:20000]
:OUTPUT ACCEPT [26183:2224589]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 808 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3128 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8088 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8084 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 15210 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 15211 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 15223 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 30001 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 4869 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 11211 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 7000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 6000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 15440 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 12000 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 12000 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 12001 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 12001 -j ACCEPT
-A FORWARD -d 192.168.10.210/32 -o eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -s 192.168.10.210/32 -i eth0 -p tcp -m tcp --sport 22 -j ACCEPT
-A FORWARD -d 192.168.10.246/32 -o eth0 -p udp -m udp --dport 12000 -j ACCEPT
-A FORWARD -s 192.168.10.246/32 -i eth0 -p udp -m udp --sport 12000 -j ACCEPT
# 以下两条的意思是在INPUT表和FORWARD表中拒绝所有其他不符合上述任何一条规则的数据包,所以必须放在此节最后
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
*nat
:PREROUTING ACCEPT [10000:20000]
:POSTROUTING ACCEPT [20:20000]
:OUTPUT ACCEPT [125:20000]
-A PREROUTING -p tcp -m tcp --dport 15210 -j DNAT --to-destination 192.168.10.210:22
-A PREROUTING -p tcp -m tcp --dport 12000 -j DNAT --to-destination 192.168.10.246:12000
-A PREROUTING -p udp -m udp --dport 12000 -j DNAT --to-destination 192.168.10.246:12000
-A POSTROUTING -d 192.168.10.210/32 -p tcp -m tcp --dport 22 -j SNAT --to-source 192.168.10.250
-A POSTROUTING -d 192.168.10.246/32 -p tcp -m tcp --dport 12000 -j SNAT --to-source 192.168.10.250
-A POSTROUTING -d 192.168.10.246/32 -p udp -m udp --dport 12000 -j SNAT --to-source 192.168.10.250
COMMIT
(注：
192.168.10.250是外网可以访问的服务器的内网地址，这一台机是有直接外网IP的。
192.168.10.246是内网里面的一台服务器，这台服务器与192.168.10.250在同一个子网，但没有外网IP，必须通过192.168.10.250跳转过来
)
