# Proxmox WLAN IP-Tables
### V4
```
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*filter
:INPUT ACCEPT [479923:96015305]
:FORWARD ACCEPT [309996:354561575]
:OUTPUT ACCEPT [475252:104246097]
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 51820 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 80 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8080 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 8443 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p tcp -m tcp --dport 53 -j ACCEPT
# -A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 53 -j ACCEPT
-A FORWARD -d 192.168.250.2/32 -p udp -m udp --dport 67 -j ACCEPT

COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*raw
:PREROUTING ACCEPT [936759:484955391]
:OUTPUT ACCEPT [475255:104246408]
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 100
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
-A PREROUTING -i fwbr+ -j CT --zone 1
COMMIT
# Completed on Sun Jul 26 18:26:48 2026
# Generated by iptables-save v1.8.11 on Sun Jul 26 18:26:48 2026
*nat
:PREROUTING ACCEPT [157187:35876890]
:INPUT ACCEPT [9697:1450815]
:OUTPUT ACCEPT [12692:835211]
:POSTROUTING ACCEPT [12719:836855]
-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.250.2:51820
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination 192.168.250.2:8080
-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 192.168.250.2:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination 192.168.250.2:8443

# -A PREROUTING -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.250.2:53
# -A PREROUTING -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.250.2:53
-A PREROUTING -p udp -m udp --dport 67 -j DNAT --to-destination 192.168.250.2:67

-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j SNAT --to-source 192.168.1.2
-A POSTROUTING -s 192.168.250.0/24 -o wlp2s0 -j MASQUERADE

COMMIT
# Completed on Sun Jul 26 18:26:48 2026
```

### V6
```
# /etc/iptables/rules.v6

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 51820 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 51820 -j ACCEPT

-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 80 -j ACCEPT

-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 443 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 443 -j ACCEPT

-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8080 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8080 -j ACCEPT

-A FORWARD -d fd00:0:ffff::2/128 -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -d fd00:0:ffff::2/128 -p udp -m udp --dport 8443 -j ACCEPT

COMMIT


*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

-A PREROUTING -i fwbr+ -j CT --zone 1

COMMIT


*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820
-A PREROUTING -p udp -m udp --dport 51820 -j DNAT --to-destination [fd00:0:ffff::2]:51820

-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 8080 -j DNAT --to-destination [fd00:0:ffff::2]:8080

-A PREROUTING -p tcp -m tcp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 8443 -j DNAT --to-destination [fd00:0:ffff::2]:8443

-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080
-A PREROUTING -p udp -m udp --dport 80 -j DNAT --to-destination [fd00:0:ffff::2]:8080

-A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443
-A PREROUTING -p udp -m udp --dport 443 -j DNAT --to-destination [fd00:0:ffff::2]:8443

-A POSTROUTING -s fd00:0:ffff::/64 -o wlp2s0 -j MASQUERADE

COMMIT
```