NAT IP to different address with iptables

Send request from IP address to another IP

iptables -t nat -A OUTPUT -d 10.10.11.11 -j DNAT --to-destination 10.20.11.11

Packets to 10.10.11.11 will be sent to 10.20.11.11

View rule: 

iptables -t nat -L

Flush rule:

iptables -t nat -F

Block IP's by countries

#!/bin/bash
# block countries with iptables based on list with range of ips

# download list with range of countries ips
rm -rf /tmp/all-zones*; wget -nc http://www.ipdeny.com/ipblocks/data/countries/all-zones.tar.gz -P /tmp

mkdir /tmp/all-zones; tar -xzvf /tmp/all-zones.tar.gz -C $_

COUNTRIES_ISO_CODE_LIST=(af cu mo)

for country_iso_code in ${COUNTRIES_ISO_CODE_LIST[*]}; do

  for country_ip in $( cat /tmp/all-zones/$country_iso_code.zone ); do
    echo creating rules to $country_iso_code $country_ip
    /sbin/iptables -A INPUT -s $country_ip -m comment --comment "rule to $( echo $country_iso_code | tr '[:lower:]' '[:upper:]' ) country" -j DROP
  done
done

Simple desktop firewall linux

Simple desktop firewall linux

minimal iptables rules to allow only output connections in local machine
iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT