rendered paste body###############
Chain INPUT (policy ACCEPT 251 packets, 386K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
Chain FORWARD (policy ACCEPT 53 packets, 13127 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9100
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9030
8 320 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9020
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9010
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:443
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:80
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:22
17 899 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:25
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:993
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.199 tcp dpt:143
0 0 ACCEPT tcp -- * * 0.0.0.0/0 172.17.63.198 tcp dpt:9000
0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED
0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 401 packets, 769K bytes)
pkts bytes target prot opt in out source destination
Zeroing chain `INPUT'
Zeroing chain `FORWARD'
Zeroing chain `OUTPUT'
###############
Chain PREROUTING (policy ACCEPT 4487 packets, 328K bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:443 to:172.17.63.199:443
474 29028 DNAT tcp -- * * 0.0.0.0/0 1.2.3.183 tcp dpt:80 to:172.17.63.198:9000
70 4200 DNAT tcp -- * * 0.0.0.0/0 1.2.3.185 tcp dpt:9100 to:172.17.63.198:9100
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.188 tcp dpt:80 to:172.17.63.198:9030
22 1176 DNAT tcp -- * * 0.0.0.0/0 1.2.3.187 tcp dpt:80 to:172.17.63.198:9020
47 2660 DNAT tcp -- * * 0.0.0.0/0 1.2.3.185 tcp dpt:80 to:172.17.63.198:9010
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.184 tcp dpt:80 to:172.17.63.198:9000
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:443 to:172.17.63.199:443
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:80 to:172.17.63.199:80
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:33 to:172.17.63.199:22
390 19296 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:25 to:172.17.63.199:25
1 64 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:993 to:172.17.63.199:993
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.189 tcp dpt:143 to:172.17.63.199:143
0 0 DNAT tcp -- * * 0.0.0.0/0 1.2.3.183 tcp dpt:80 to:172.17.63.198:9000
Chain POSTROUTING (policy ACCEPT 1091 packets, 62512 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:443 to:1.2.3.189:443
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.183:80
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9100 to:1.2.3.185:9100
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9030 to:1.2.3.188:80
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9020 to:1.2.3.187:80
1 1442 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9010 to:1.2.3.185:80
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.184:80
1847 134K MASQUERADE all -- * * 172.17.63.0/24 !172.17.63.0/24
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:443 to:1.2.3.189:443
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:80 to:1.2.3.189:80
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:22 to:1.2.3.189:33
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:25 to:1.2.3.189:25
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:993 to:1.2.3.189:993
0 0 SNAT tcp -- * * 172.17.63.199 0.0.0.0/0 tcp spt:143 to:1.2.3.189:143
0 0 SNAT tcp -- * * 172.17.63.198 0.0.0.0/0 tcp spt:9000 to:1.2.3.183:80
0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122.0/24
Chain OUTPUT (policy ACCEPT 67 packets, 4888 bytes)
pkts bytes target prot opt in out source destination
Zeroing chain `PREROUTING'
Zeroing chain `POSTROUTING'
Zeroing chain `OUTPUT'
########### ip addr sh ccbr
4: ccbr: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
link/ether 00:24:8c:bf:15:16 brd ff:ff:ff:ff:ff:ff
inet 1.2.3.181/28 brd 1.2.3.191 scope global ccbr
inet 1.2.3.183/28 scope global secondary ccbr
inet 1.2.3.189/28 scope global secondary ccbr
inet 1.2.3.188/28 scope global secondary ccbr
inet 1.2.3.187/28 scope global secondary ccbr
inet 1.2.3.185/28 scope global secondary ccbr
inet 1.2.3.184/28 scope global secondary ccbr
inet6 fe80::224:8cff:febf:1516/64 scope link
valid_lft forever preferred_lft forever
########## ip ro
1.2.3.176/28 dev ccbr proto kernel scope link src 1.2.3.181
172.17.63.0/24 dev i17br proto kernel scope link src 172.17.63.99
192.168.10.0/24 dev eth0 proto kernel scope link src 192.168.10.99
192.168.122.0/24 dev virbr0 proto kernel scope link src 192.168.122.1
172.17.0.0/16 dev i17br proto kernel scope link src 172.17.63.250
192.168.0.0/16 via 192.168.10.61 dev eth0
default via 1.2.3.190 dev ccbr