vpn客户端-因特网-iptables网关-vpnserver

iptables

iptables -t nat -A PREROUTING -d 61.123.xx.xx -p tcp -m tcp –dport 1723 -j DNAT –to-destination 10.10.10.207:1723
iptables -t nat -A PREROUTING -d 61.123.xx.xx -p udp -m udp –dport 1701 -j DNAT –to-destination 10.10.10.207:1701
iptables -t nat -A PREROUTING -d 61.123.xx.xx -p gre -j DNAT –to-destination 10.10.10.207

iptables -I FORWARD -p tcp -s 192.168.1.0/24 --dport 1723 -j ACCEPT
iptables -I FORWARD -p gre -s 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -p gre -d 192.168.1.0/24 -j ACCEPT

注：
    视具体而开放1723端口;
    基于TCP的双向特性，GRE包必须是双向允许