iptables и проброс портов

# Generated by iptables-save v1.3.5 on Tue May 10 08:35:47 2011
*filter
:INPUT ACCEPT [11903:1546621]
:FORWARD ACCEPT [4422:208966]
:OUTPUT ACCEPT [12488:6392817]
-A FORWARD -d 192.168.100.1 -i eth0 -o tun0 -p tcp -m tcp --dport 80 -j ACCEPT 
COMMIT
# Completed on Tue May 10 08:35:47 2011
# Generated by iptables-save v1.3.5 on Tue May 10 08:35:47 2011
*nat
:PREROUTING ACCEPT [2450:229555]
:POSTROUTING ACCEPT [11:1064]
:OUTPUT ACCEPT [11:1064]
-A PREROUTING -d 10.10.10.10 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.1:80 
-A POSTROUTING -d 192.168.100.1 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.100.101 
-A OUTPUT -d 10.10.10.10 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.100.1 
COMMIT
# Completed on Tue May 10 08:35:47 2011

-A POSTROUTING -d 192.168.100.1 -p tcp -m tcp --dport 80 -j SNAT --to-source 192.168.100.101