TomatoUSB

[root@E3000 /]$ cat /tmp/etc/iptables.error 
*mangle
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:WANPREROUTING - [0:0]
-A PREROUTING -d 192.168.25.22 -j WANPREROUTING
-A PREROUTING -i vlan2 -d 192.168.1.1/255.255.255.0 -j DROP
-A WANPREROUTING -p icmp -j DNAT --to-destination 192.168.1.1
-A WANPREROUTING -p tcp  --dport 54323 -j DNAT --to-destination 192.168.1.100:21
-A WANPREROUTING -p tcp  --dport 54321 -j DNAT --to-destination 192.168.1.100:22
-A WANPREROUTING -p tcp  --dport 54322 -j DNAT --to-destination 192.168.1.100:5900
:upnp - [0:0]
-A PREROUTING -d 192.168.25.22 -j upnp
-A POSTROUTING  -o vlan2 -j MASQUERADE
-A POSTROUTING -o br0 -s 192.168.1.1/255.255.255.0 -d 192.168.1.1/255.255.255.0 -j SNAT --to-source 192.168.1.1
COMMIT
*filter
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state INVALID -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-N shlimit
-A shlimit -m recent --set --name shlimit
-A shlimit -m recent --update --hitcount 21 --seconds 60 --name shlimit -j DROP
-A INPUT -p tcp --dport 22 -m state --state NEW -j shlimit
-A INPUT -i lo -j ACCEPT
-A INPUT -i br0 -j ACCEPT
-A INPUT -p udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -p tcp  --dport 8080 -j ACCEPT
-A INPUT -p tcp  --dport 22 -j ACCEPT
-A INPUT -p tcp  --dport 21 -j ACCEPT
-A INPUT -p tcp --dport 51515 -j ACCEPT
:FORWARD DROP [0:0]
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
:wanin - [0:0]
:wanout - [0:0]
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i vlan2 -j wanin
-A FORWARD -o vlan2 -j wanout
-A FORWARD -i br0 -o vlan2 -j ACCEPT
:upnp - [0:0]
-A FORWARD -i vlan2 -j upnp
-A wanin  -p tcp -m tcp -d 192.168.1.100 --dport 21 -j ACCEPT
-A wanin  -p tcp -m tcp -d 192.168.1.100 --dport 22 -j ACCEPT
-A wanin  -p tcp -m tcp -d 192.168.1.100 --dport 5900 -j ACCEPT
COMMIT