*nat
:PREROUTING ACCEPT [56:4759]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#192.168.0.10
-A PREROUTING -d 1.3.7.5 -p tcp -m tcp --dport 2210 -j DNAT --to-destination 192.168.0.10:22
#192.168.0.11
-A PREROUTING -d 1.3.7.5 -p tcp -m tcp --dport 2211 -j DNAT --to-destination 192.168.0.11:22
#192.168.0.12
-A PREROUTING -d 1.3.7.5 -p tcp -m tcp --dport 2212 -j DNAT --to-destination 192.168.0.12:22
#192.168.0.13
-A PREROUTING -d 1.3.7.4 -p tcp -m tcp --dport 2213 -j DNAT --to-destination 192.168.0.13:22
#192.168.0.14
-A PREROUTING -d 1.3.7.4 -p tcp -m tcp --dport 2214 -j DNAT --to-destination 192.168.0.14:12012
-A POSTROUTING -j MASQUERADE
COMMIT

Completed on Fri Aug 26 17:36:07 2016

Generated by iptables-save v1.4.7 on Fri Aug 26 17:36:07 2016

*filter
:INPUT ACCEPT [937:98306]
:FORWARD ACCEPT [85:7140]
:OUTPUT ACCEPT [352:28672]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 20002 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 6320 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 6379 -j ACCEPT
#-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT

Completed on Fri Aug 26 17:36:07 2016

Linux服务器被当做防火墙做NAT

原文：http://blog.51cto.com/11403002/2341880