:input ACCEPT
:forward DENY
:output ACCEPT
-A forward -s 10.0.0.0/255.0.0.0 -d 0.0.0.0/0.0.0.0 -j MASQ
-A forward -s 999.999.999.999/255.255.255.224 -d 0.0.0.0/0.0.0.0 -j ACCEPT