> и обращаетесь на внешний ip, вывод сюда. И так же iptables-save уже
> давно нужно было показать 08:22:09.132687 IP 192.168.0.5.1162 > внешний_ip.9000: S 1814991:1814991(0) win 65535 <mss 1460,nop,nop,sackOK>
08:22:09.132771 IP внешний_ip.9000 > 192.168.0.5.1162: R 0:0(0) ack 1814992 win 0
08:22:09.584812 IP 192.168.0.5.1162 > внешний_ip.9000: S 1814991:1814991(0) win 65535 <mss 1460,nop,nop,sackOK>
08:22:09.584872 IP внешний_ip.9000 > 192.168.0.5.1162: R 0:0(0) ack 1 win 0
08:22:10.131690 IP 192.168.0.5.1162 > внешний_ip.9000: S 1814991:1814991(0) win 65535 <mss 1460,nop,nop,sackOK>
08:22:10.131741 IP внешний_ip.9000 > 192.168.0.5.1162: R 0:0(0) ack 1 win 0
iptables-save
# Generated by iptables-save v1.4.1.1 on Tue May 21 08:24:40 2013
*raw
:PREROUTING ACCEPT [30968193:5291718836]
:OUTPUT ACCEPT [22278252:5148751522]
COMMIT
# Completed on Tue May 21 08:24:40 2013
# Generated by iptables-save v1.4.1.1 on Tue May 21 08:24:40 2013
*nat
:PREROUTING ACCEPT [2505036:123358820]
:POSTROUTING ACCEPT [6219:490369]
:OUTPUT ACCEPT [6180:488809]
:eth0_masq - [0:0]
-A PREROUTING -d внешний_ip/32 -p tcp -m tcp --dport 9000 -j DNAT --to-destination 192.168.0.223
-A PREROUTING -d внешний_ip/32 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.0.223:8080
-A POSTROUTING -o eth0 -j eth0_masq
-A eth0_masq -s 192.168.0.0/24 -j MASQUERADE
COMMIT
# Completed on Tue May 21 08:24:40 2013
# Generated by iptables-save v1.4.1.1 on Tue May 21 08:24:40 2013
*mangle
:PREROUTING ACCEPT [30968193:5291718836]
:INPUT ACCEPT [22839434:3373888396]
:FORWARD ACCEPT [8126196:1917696066]
:OUTPUT ACCEPT [22278252:5148751522]
:POSTROUTING ACCEPT [30404960:7066585052]
:tcfor - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
-A PREROUTING -j tcpre
-A FORWARD -j tcfor
-A OUTPUT -j tcout
-A POSTROUTING -j tcpost
COMMIT
# Completed on Tue May 21 08:24:40 2013
# Generated by iptables-save v1.4.1.1 on Tue May 21 08:24:40 2013
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Drop - [0:0]
:Ifw - [0:0]
:Reject - [0:0]
:all2fw - [0:0]
:all2loc - [0:0]
:all2net - [0:0]
:dropBcast - [0:0]
:dropInvalid - [0:0]
:dropNotSyn - [0:0]
:dynamic - [0:0]
:eth0_fwd - [0:0]
:eth0_in - [0:0]
:eth0_out - [0:0]
:eth1_fwd - [0:0]
:eth1_in - [0:0]
:eth1_out - [0:0]
:fw2all - [0:0]
:fw2loc - [0:0]
:fw2net - [0:0]
:loc2all - [0:0]
:loc2fw - [0:0]
:loc2net - [0:0]
:logdrop - [0:0]
:logreject - [0:0]
:net2fw - [0:0]
:net2loc - [0:0]
:reject - [0:0]
:shorewall - [0:0]
:smurfs - [0:0]
-A INPUT -j Ifw
-A INPUT -i eth0 -j eth0_in
-A INPUT -i eth1 -j eth1_in
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j Reject
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6
-A INPUT -j reject
-A FORWARD -i eth0 -j eth0_fwd
-A FORWARD -i eth1 -j eth1_fwd
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j Reject
-A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6
-A FORWARD -j reject
-A FORWARD -s 192.168.0.223/32 -p tcp -m tcp --sport 9000 -j ACCEPT
-A FORWARD -s 192.168.0.223/32 -p tcp -m tcp --sport 8080 -j ACCEPT
-A OUTPUT -o eth0 -j eth0_out
-A OUTPUT -o eth1 -j eth1_out
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j Reject
-A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6
-A OUTPUT -j reject
-A Drop -p tcp -m tcp --dport 113 -j reject
-A Drop -j dropBcast
-A Drop -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A Drop -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A Drop -j dropInvalid
-A Drop -p udp -m multiport --dports 135,445 -j DROP
-A Drop -p udp -m udp --dport 137:139 -j DROP
-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -j DROP
-A Drop -p tcp -m multiport --dports 135,139,445 -j DROP
-A Drop -p udp -m udp --dport 1900 -j DROP
-A Drop -p tcp -j dropNotSyn
-A Drop -p udp -m udp --sport 53 -j DROP
-A Ifw -m set --set ifw_wl src -j RETURN
-A Ifw -m set --set ifw_bl src -j DROP
-A Ifw -m state --state INVALID,NEW -m psd --psd-weight-threshold 10 --psd-delay-threshold 10000 --psd-lo-ports-weight 2 --psd-hi-ports-weight 1 -j IFWLOG --log-prefix "SCAN"
-A Ifw -p udp -m state --state NEW -m udp --dport 53 -j IFWLOG --log-prefix "NEW"
-A Ifw -p udp -m state --state NEW -m udp --dport 137 -j IFWLOG --log-prefix "NEW"
-A Ifw -p udp -m state --state NEW -m udp --dport 138 -j IFWLOG --log-prefix "NEW"
-A Ifw -p udp -m state --state NEW -m udp --dport 139 -j IFWLOG --log-prefix "NEW"
-A Ifw -p udp -m state --state NEW -m udp --dport 445 -j IFWLOG --log-prefix "NEW"
-A Ifw -p udp -m state --state NEW -m multiport --dports 1024:1100 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 80 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 443 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 53 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 22 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 20 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 21 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 25 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 109 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 110 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 143 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 137 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 138 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 139 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 445 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m multiport --dports 1024:1100 -j IFWLOG --log-prefix "NEW"
-A Ifw -p tcp -m state --state NEW -m tcp --dport 8080 -j IFWLOG --log-prefix "NEW"
-A Reject -p tcp -m tcp --dport 113 -j reject
-A Reject -j dropBcast
-A Reject -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A Reject -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A Reject -j dropInvalid
-A Reject -p udp -m multiport --dports 135,445 -j reject
-A Reject -p udp -m udp --dport 137:139 -j reject
-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -j reject
-A Reject -p tcp -m multiport --dports 135,139,445 -j reject
-A Reject -p udp -m udp --dport 1900 -j DROP
-A Reject -p tcp -j dropNotSyn
-A Reject -p udp -m udp --sport 53 -j DROP
-A all2fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A all2fw -j Reject
-A all2fw -j LOG --log-prefix "Shorewall:all2fw:REJECT:" --log-level 6
-A all2fw -j reject
-A all2loc -m state --state RELATED,ESTABLISHED -j ACCEPT
-A all2loc -j Reject
-A all2loc -j LOG --log-prefix "Shorewall:all2loc:REJECT:" --log-level 6
-A all2loc -j reject
-A all2net -m state --state RELATED,ESTABLISHED -j ACCEPT
-A all2net -j Reject
-A all2net -j LOG --log-prefix "Shorewall:all2net:REJECT:" --log-level 6
-A all2net -j reject
-A dropBcast -m addrtype --dst-type BROADCAST -j DROP
-A dropBcast -d 224.0.0.0/4 -j DROP
-A dropInvalid -m state --state INVALID -j DROP
-A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A eth0_fwd -m state --state INVALID,NEW -j dynamic
-A eth0_fwd -o eth1 -j net2loc
-A eth0_in -m state --state INVALID,NEW -j dynamic
-A eth0_in -j net2fw
-A eth0_out -j fw2net
-A eth1_fwd -m state --state INVALID,NEW -j dynamic
-A eth1_fwd -o eth0 -j loc2net
-A eth1_in -m state --state INVALID,NEW -j dynamic
-A eth1_in -j loc2fw
-A eth1_out -j fw2loc
-A fw2all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2all -j Reject
-A fw2all -j LOG --log-prefix "Shorewall:fw2all:REJECT:" --log-level 6
-A fw2all -j reject
-A fw2loc -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2loc -j ACCEPT
-A fw2net -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2net -j ACCEPT
-A loc2all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc2all -j Reject
-A loc2all -j LOG --log-prefix "Shorewall:loc2all:REJECT:" --log-level 6
-A loc2all -j reject
-A loc2fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc2fw -j ACCEPT
-A loc2net -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc2net -j ACCEPT
-A logdrop -j DROP
-A logreject -j reject
-A net2fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A net2fw -p udp -m multiport --dports 53,137,138,139,445,8080,1024:1100 -j ACCEPT
-A net2fw -p tcp -m multiport --dports 80,443,53,22,20,21,25,109,110,143,137,138,139,445 -j ACCEPT
-A net2fw -p tcp -m multiport --dports 1024:1100,8080 -j ACCEPT
-A net2fw -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A net2fw -j Drop
-A net2fw -j LOG --log-prefix "Shorewall:net2fw:DROP:" --log-level 6
-A net2fw -j DROP
-A net2loc -m state --state RELATED,ESTABLISHED -j ACCEPT
-A net2loc -j Drop
-A net2loc -j LOG --log-prefix "Shorewall:net2loc:DROP:" --log-level 6
-A net2loc -j DROP
-A reject -m addrtype --src-type BROADCAST -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A smurfs -s 0.0.0.0/32 -j RETURN
-A smurfs -m addrtype --src-type BROADCAST -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurfs -m addrtype --src-type BROADCAST -j DROP
-A smurfs -s 224.0.0.0/4 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurfs -s 224.0.0.0/4 -j DROP
COMMIT
# Completed on Tue May 21 08:24:40 2013