iptables проброс портов
Не работает проброс портов. Вывод iptables-save
root@internet-server:/etc/rc# iptables-save
# Generated by iptables-save v1.4.21 on Thu Nov 26 15:36:21 2015
*mangle
:PREROUTING ACCEPT [2468:121161]
:INPUT ACCEPT [2403:117627]
:FORWARD ACCEPT [18:944]
:OUTPUT ACCEPT [2246:118853]
:POSTROUTING ACCEPT [2264:119797]
COMMIT
# Completed on Thu Nov 26 15:36:21 2015
# Generated by iptables-save v1.4.21 on Thu Nov 26 15:36:21 2015
*nat
:PREROUTING ACCEPT [91:5543]
:INPUT ACCEPT [28:2313]
:OUTPUT ACCEPT [1068:47149]
:POSTROUTING ACCEPT [1075:47537]
-A PREROUTING -d 94.230.119.252/32 -p tcp -m tcp --dport 55666 -j DNAT --to-destination 192.168.0.77:3389
-A POSTROUTING -s 192.168.0.0/24 -o p5p1 -j MASQUERADE
-A POSTROUTING -o 192.168.0.77 -p tcp -m tcp --sport 3389 -j SNAT --to-source 94.230.119.252:55666
COMMIT
# Completed on Thu Nov 26 15:36:21 2015
# Generated by iptables-save v1.4.21 on Thu Nov 26 15:36:21 2015
*filter
:INPUT DROP [8:272]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i p3p1 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -i p5p1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i p5p1 -p tcp -m tcp --dport 1194 -j ACCEPT
-A INPUT -i p5p1 -p tcp -m tcp --dport 55666 -j ACCEPT
-A INPUT -i p5p1 -p tcp -m multiport --sports 55666 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i p5p1 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i p3p1 -o p5p1 -j ACCEPT
-A FORWARD -i p5p1 -o p3p1 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -d 192.168.0.77/32 -i p5p1 -p tcp -m tcp --dport 3389 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o p3p1 -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
COMMIT
# Completed on Thu Nov 26 15:36:21 2015
root@internet-server:/etc/rc# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: p3p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 64:66:b3:04:38:b5 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.181/24 brd 192.168.0.255 scope global p3p1
valid_lft forever preferred_lft forever
inet6 fe80::6666:b3ff:fe04:38b5/64 scope link
valid_lft forever preferred_lft forever
3: p5p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 50:46:5d:90:0b:c2 brd ff:ff:ff:ff:ff:ff
inet 94.230.119.252/24 brd 94.230.119.255 scope global p5p1
valid_lft forever preferred_lft forever
inet6 fe80::5246:5dff:fe90:bc2/64 scope link
valid_lft forever preferred_lft forever
4: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
link/none
inet 192.168.10.1 peer 192.168.10.2/32 scope global tun0
valid_lft forever preferred_lft forever
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT all -- p3p1 * 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
4 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
5 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
6 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
7 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1194
8 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:55666
9 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 0.0.0.0/0 multiport sports 55666
10 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
11 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 TCPMSS tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
2 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
3 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
4 0 0 ACCEPT all -- p3p1 p5p1 0.0.0.0/0 0.0.0.0/0
5 0 0 REJECT all -- p5p1 p3p1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
6 0 0 ACCEPT tcp -- p5p1 * 0.0.0.0/0 192.168.0.77 tcp dpt:3389
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT all -- * p3p1 0.0.0.0/0 0.0.0.0/0
3 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED
4 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW
вывод sysctl -p
root@internet-server:/etc/rc# sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1