[root@unknown root]$ cat /etc/iptables

*mangle

:PREROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-I PREROUTING -i ppp0 -j DSCP --set-dscp 0

COMMIT

*nat

:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

:WANPREROUTING - [0:0]

-A PREROUTING -d IPZEWNROUTERA -j WANPREROUTING

-A PREROUTING -i ppp0 -d 192.168.15.1/255.255.255.0 -j DROP

-A WANPREROUTING -p icmp -j DNAT --to-destination 192.168.15.1

-A WANPREROUTING -p tcp  --dport 10101 -j DNAT --to-destination 192.168.15.1:10101

-A POSTROUTING  -o ppp0 -j MASQUERADE

-A POSTROUTING -o br0 -s 192.168.15.1/255.255.255.0 -d 192.168.15.1/255.255.255.0 -j SNAT --to-source 192.168.15.1

COMMIT

*filter

:INPUT DROP [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state INVALID -j DROP

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-N shlimit

-A shlimit -m recent --set --name shlimit

-A shlimit -m recent --update --hitcount 4 --seconds 60 --name shlimit -j DROP

-A INPUT -p tcp --dport 22 -m state --state NEW -j shlimit

-A INPUT -i lo -j ACCEPT

-A INPUT -i br0 -j ACCEPT

-A INPUT -p tcp  --dport 8080 -j ACCEPT

:FORWARD DROP [0:0]

-A FORWARD -m account --aaddr 192.168.15.0/255.255.255.0 --aname lan

-A FORWARD -i br0 -o br0 -j ACCEPT

-A FORWARD -m state --state INVALID -j DROP

-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

:wanin - [0:0]

:wanout - [0:0]

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -i ppp0 -j wanin

-A FORWARD -o ppp0 -j wanout

-A FORWARD -i br0 -j ACCEPT

-A wanin  -p tcp -m tcp -d 192.168.15.1 --dport 10101 -j ACCEPT

COMMIT