This forces any UDP packets reaching your nat'ed interface to 192.168.0.1
iptables –t nat –A PREROUTING –p udp –j DNAT –-to 192.168.0.1
This sets the default policy for your FORWARD table to ACCEPT, basically, if a packet doesn't match any FORWARD rule, it will default to ACCEPT. Anything have to go from one interface to another will pass through the FORWARD table. Ex. at0 to eth0
iptables –P FORWARD ACCEPT
This sets eth0 as your nat'ed interface
iptables –-table nat –-append POSTROUTING –-out-interface eth0 –j MASQUERADE
The first command forces any udp traffic to 192.168.0.1, so if anyone tries to reach a udp service on the outside (tftp, etc..) it will not work (unless that service is running on 192.168.0.1). The reason you don't have to specify 80 is because their is no rule denying it, so it passes through your nat'ed interface without issue.
Originally Posted by ioannou.alexandros