在DROP策略上的端口转发

我正在尝试在端口80上执行端口转发到虚拟机。 如果在input，输出和转发链上设置默认策略为ACCEPT，则转发工作。 但是，如果我把这个政策放在DROP上，打开相关的港口，我就无法工作了。 我错过了什么？

#!/bin/bash IPT="/sbin/iptables" echo "Starting IPv4 Wall..." $IPT -F $IPT -X $IPT -t nat -F $IPT -t nat -X $IPT -t filter -F $IPT -t filter -X $IPT -t mangle -F $IPT -t mangle -X $IPT -t nat -F PREROUTING $IPT -t nat -F POSTROUTING $IPT -t nat -F OUTPUT #modprobe ip_conntrack # DROP all incomming traffic $IPT -P INPUT DROP $IPT -P OUTPUT DROP $IPT -P FORWARD ACCEPT # Unlimited Access to localhost $IPT -A INPUT -i lo -j ACCEPT $IPT -A OUTPUT -o lo -j ACCEPT #Allow ESTABLISHED,RELATED $IPT -A INPUT -i em4 -m state --state ESTABLISHED,RELATED -j ACCEPT $IPT -A OUTPUT -o em4 -m state --state ESTABLISHED,RELATED -j ACCEPT #Allow outbound SYN requests $IPT -A OUTPUT -o em4 -m state --state NEW -j ACCEPT #Allow SSH (Port 22) $IPT -A INPUT -i em4 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o em4 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT ### Allow HTTP port 80 ###$IPT -A INPUT -i em4 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT ###$IPT -A OUTPUT -o em4 -p tcp --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT # allow HTTP & HTTPS $IPT -A OUTPUT -p tcp -m multiport --dports 80,443 -j ACCEPT $IPT -A INPUT -p tcp -m multiport --sports 80,443 -j ACCEPT # allow DNS $IPT -A OUTPUT -p udp --dport 53 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT $IPT -A INPUT -p udp --sport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow Ports 2222:2226 $IPT -A INPUT -i em4 -p tcp --dport 2222:2226 -m state --state NEW,ESTABLISHED -j ACCEPT $IPT -A OUTPUT -o em4 -p tcp --sport 2222:2226 -m state --state NEW,ESTABLISHED -j ACCEPT ##funciona $IPT -t nat -A PREROUTING -p tcp --dst $EXTERNALIP --dport 80 -j DNAT --to-destination 192.168.122.1:8080 $IPT -t nat -A POSTROUTING -p tcp --dst 192.168.122.1 --dport 8080 -j SNAT --to-source $EXTERNALIP $IPT -t nat -A OUTPUT --dst $EXTERNALIP -p tcp --dport 80 -j DNAT --to-destination 192.168.122.1:8080 $IPT -I FORWARD -j LOG --log-prefix "iptables denied" echo "Done, exiting" exit 0