一些命令，copy来的

iptables -t nat -A PREROUTING -d 10.85.10.164 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -s 192.168.122.0/255.255.255.0 -d 192.168.122.46 -p tcp -m tcp --dport 3389 -j SNAT --to-source 10.85.10.164


-A PREROUTING -i eth1 -p tcp -d 221.222.111.10 --dport 80 -j DNAT --to-destination 192.168.0.200:80
-A POSTROUTING -s 192.168.0.0/255.255.255.0 -j SNAT --to 221.222.111.10



iptables -t nat -A PREROUTING -p tcp -d 10.85.10.164 --dport 3389 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -s 192.168.122.46/255.255.255.0 -j SNAT --to 10.85.10.164
iptables -A INPUT -p tcp --dport 3389 -j ACCEPT


iptables -t nat -A PREROUTING -p tcp -m tcp -d 10.85.10.164 --dport 8889 -j DNAT --to-destination 192.168.122.46:3389
iptables -t nat -A POSTROUTING -p tcp -m tcp -d 192.168.122.46 --dport 3389 -j SNAT --to 10.85.10.164



iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat










    8、转发本网段的机器到任何地方去的包：iptables -A FORWARD -s 172.16.3.0/24 -j ACCEPT
    9、对先前从防火墙外部接口出去的请求包的回复：iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
    10、打开IP伪装能：iptables -t nat -A POSTROUTING -o eth0 -s 172.16.3.0/24 -j MASQUERADE
    11、目标端口为80的包可以进入：iptables -A INPUT -p tcp -i eth0 --syn --dport 80 -j ACCEPT
    12、拒绝不是目标端口是80的所求TCP新的连接请求包：iptables -A INPUT -p tcp -i eth0 --syn -j DROP
    13、工作站的IP地址设为：172.16.3.* 掩码：255.255.255.0网关:172.16.3.254
    这样，工作站用户即使不设置任何代理，也同样可以上网。




iptables -A FORWARD -s 192.168.122.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.122.0/24 -j MASQUERADE


iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

## nat Table
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.10.0/24 -j MASQUERADE





























iptables -A INPUT -i virbr0 -j ACCEPT
iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -s 192.168.122.0/24 -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.122.0/24 -j MASQUERADE



iptables -t nat -A POSTROUTING -s 192.168.122.0/24 -o eth0 -j SNAT --to 10.85.10.164