*mangle

:PREROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

COMMIT

*nat

:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:WANPREROUTING - [0:0]

-A PREROUTING -d ip+z+wan -j WANPREROUTING

-A PREROUTING -i vlan2 -d 192.168.1.1/255.255.255.0 -j DROP

-A WANPREROUTING -p icmp -j DNAT --to-destination 192.168.1.1

-A POSTROUTING -o vlan2 -j MASQUERADE

COMMIT

*filter

:INPUT DROP [0:0]

:OUTPUT ACCEPT [0:0]

:logdrop - [0:0]

-A logdrop -m state --state NEW -m limit --limit 60/m -j LOG --log-prefix "DROP " --log-tcp-options --log-ip-options

-A logdrop -j DROP

:logreject - [0:0]

-A logreject -m limit --limit 60/m -j LOG --log-prefix "REJECT " --log-tcp-options --log-ip-options

-A logreject -p tcp -j REJECT --reject-with tcp-reset

-A INPUT -i br0 -d ip_z_wan -j DROP

-A INPUT -m state --state INVALID -j logdrop

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -i br0 -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p udp --sport 67 --dport 68 -j ACCEPT

-A INPUT -j logdrop

:FORWARD DROP [0:0]

-A FORWARD -i br0 -o br0 -j ACCEPT

-A FORWARD -m state --state INVALID -j DROP

-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

:wanin - [0:0]

:wanout - [0:0]

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i vlan2 -j wanin

-A FORWARD -o vlan2 -j wanout

-A FORWARD -i br0 -j ACCEPT

COMMIT

tcp        0      0 0.0.0.0:9091            0.0.0.0:*               LISTEN

tcp        0      0 pomidor:netbios-ssn     0.0.0.0:*               LISTEN

tcp        0      0 pomidor:www             0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:domain          0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:ftp             0.0.0.0:*               LISTEN

tcp        0      0 localhost:12345         0.0.0.0:*               LISTEN

tcp        0      0 pomidor:445             0.0.0.0:*               LISTEN

tcp        0      0 0.0.0.0:52222           0.0.0.0:*               LISTEN