Взлетело после того как добавил $IPTABLES -A INPUT -p UDP --dport 53 -j ACCEPT
Сейчас iptables-save выглядит так:
*filter
:INPUT DROP [20:988]
:FORWARD DROP [1:113]
:OUTPUT DROP [1:67]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -s 192.168.100.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.100.1 -i lo -j ACCEPT
-A INPUT -s 192.168.255.10 -i lo -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i tun+ -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -d 192.168.255.10 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_packets
-A INPUT -i eth1 -p udp -j udp_packets
-A INPUT -i eth1 -p icmp -j icmp_packets
-A FORWARD -d 192.168.100.2 -i eth1 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p gre -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p icmp -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 1723 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 4666 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 4667 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 10000 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 500 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 1119 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 1999 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p tcp -m tcp --dport 6112:6119 -j ACCEPT
-A FORWARD -s 192.168.100.0/255.255.255.0 -p udp -m udp --dport 6112:6119 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 9.16.142.1 -j ACCEPT
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.100.1 -j ACCEPT
-A OUTPUT -s 192.168.255.10 -j ACCEPT
-A allowed -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 20 -j allowed
-A tcp_packets -p tcp -m tcp --dport 25 -j allowed
-A tcp_packets -p tcp -m tcp --dport 995 -j allowed
-A tcp_packets -i eth1 -p tcp -m state --state NEW -m tcp --dport 2222 -m recent --update --seconds 20 --name DEFAULT --rsource -j DROP
-A tcp_packets -i eth1 -p tcp -m state --state NEW -m tcp --dport 2222 -m recent --set --name DEFAULT --rsource -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 8080 -j allowed
-A udp_packets -p udp -m udp --dport 8080 -j ACCEPT
-A udp_packets -p udp -m udp --dport 20 -j ACCEPT
*mangle
:PREROUTING ACCEPT [95867249:62829537320]
:INPUT ACCEPT [93601603:62320581881]
:FORWARD ACCEPT [2265475:508939918]
:OUTPUT ACCEPT [97824942:76206443864]
:POSTROUTING ACCEPT [99120443:76669376773]
COMMIT
*nat
:PREROUTING ACCEPT [2387791:126826150]
:POSTROUTING ACCEPT [533651:38000456]
:OUTPUT ACCEPT [779358:57865151]
-A PREROUTING -d 192.168.255.10 -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.100.2:443
-A POSTROUTING -o eth1 -j SNAT --to-source 192.168.255.10
COMMIT
