iptables -A INPUT -p tcp --dport 22 -j ACCEPT, то нужно будет и правило iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT. Но обычной практикой является то, что OUTPUT оставляют пустым с политикой ACCEPT.iptables -A INPUT -i lo -j ACCEPT для того, чтобы разрешить коммуникации между процессами на самом хосте, и правило iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTiptables -t mangle -A PREROUTING --dst <subnet/prefix> -m statistic --mode nth --every 3 -j MARK --set-mark 0x1
iptables -t mangle -A PREROUTING --dst <subnet/prefix> -m mark ! --mark 0x1 -m statistic --mode nth --every 2 -j MARK --set-mark 0x2
iptables -t mangle -A PREROUTING --dst <subnet/prefix> -m mark ! --mark 0x1 -m mark ! --mark 0x2 -j MARK --set-mark 0x3~$ ip -4 a ls dev lo
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
inet 127.0.0.1/8 scope host lo
~$ ip -4 a ls dev eth0.200
4: eth0.200@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
inet 172.27.65.228/16 brd 172.27.255.255 scope global eth0.200
~$ sudo iptables -t nat -L OUTPUT -n -v
Chain OUTPUT (policy ACCEPT 295 packets, 17876 bytes)
pkts bytes target prot opt in out source destination
28 1660 DNAT tcp -- * * 0.0.0.0/0 127.0.0.1 tcp dpt:65001 to:1.1.1.1:8001
2 120 DNAT tcp -- * * 0.0.0.0/0 172.27.65.228 tcp dpt:65001 to:1.1.1.1:8002~$ telnet 127.0.0.1 65001
~$ sudo conntrack -L --orig-dst 127.0.0.1
conntrack v1.2.1 (conntrack-tools): 0 flow entries have been shown.~$ telnet 172.27.65.228 65001
~$ sudo tcpdump -ni eth0.200 'ip host 1.1.1.1'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0.200, link-type EN10MB (Ethernet), capture size 65535 bytes
19:21:59.848777 IP 172.27.65.228.48735 > 1.1.1.1.8002: Flags [S], seq 3790799685, win 43690, options [mss 65495,sackOK,TS val 1388718972 ecr 0,nop,wscale 7], length 0
19:22:00.850050 IP 172.27.65.228.48735 > 1.1.1.1.8002: Flags [S], seq 3790799685, win 43690, options [mss 65495,sackOK,TS val 1388719974 ecr 0,nop,wscale 7], length 0
19:22:02.852057 IP 172.27.65.228.48735 > 1.1.1.1.8002: Flags [S], seq 3790799685, win 43690, options [mss 65495,sackOK,TS val 1388721976 ecr 0,nop,wscale 7], length 0
19:22:06.860066 IP 172.27.65.228.48735 > 1.1.1.1.8002: Flags [S], seq 3790799685, win 43690, options [mss 65495,sackOK,TS val 1388725984 ecr 0,nop,wscale 7], length 0
....
~$ sudo conntrack -L --orig-src 172.27.65.228 --orig-dst 172.27.65.228
tcp 6 117 SYN_SENT src=172.27.65.228 dst=172.27.65.228 sport=48924 dport=65001 [UNREPLIED] src=1.1.1.1 dst=172.27.65.228 sport=8002 dport=48924 mark=0 use=1
conntrack v1.2.1 (conntrack-tools): 1 flow entries have been shown.chain = nat/prerouting,
input-interface = ether1,
dst-ip = 1.2.3.4,
protocol = tcp,
dst-port = 87,
action = dst-nat,
dst-nat-address = 192.168.0.2,
dst-nat-port = 87.chain = nat/prerouting
input-interface = ether2,
dst-ip 1.2.3.4,
src-ip = 192.168.0.0/24,
protocol = tcp,
dst-port = 87,
action = dst-nat,
dst-nat-address = 192.168.0.2,
dst-nat-port = 87.chain = nat/postrouting,
output-interface = ether2,
dst-ip = 192.168.0.2,
src-ip = 192.168.0.0/24,
protocol = tcp,
dst-port = 87,
action = src-nat,
src-nat-address = 192.168.0.1[!] --ctstate {INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED|SNAT|DNAT}[,...]
State(s) to match
[!] --ctproto proto Protocol to match; by number or name, e.g. "tcp"
[!] --ctorigsrc address[/mask]
[!] --ctorigdst address[/mask]
[!] --ctreplsrc address[/mask]
[!] --ctrepldst address[/mask]
Original/Reply source/destination address
[!] --ctorigsrcport port
[!] --ctorigdstport port
[!] --ctreplsrcport port
[!] --ctrepldstport port
TCP/UDP/SCTP orig./reply source/destination port
[!] --ctstatus {NONE|EXPECTED|SEEN_REPLY|ASSURED|CONFIRMED}[,...]
Status(es) to match
[!] --ctexpire time[:time] Match remaining lifetime in seconds against
value or range of values (inclusive)
--ctdir {ORIGINAL|REPLY} Flow direction of packet