{
    my $pf_chain = "PortForwarding_\$\$";
    $OUT .= "# Create a new PortForwarding chain\n";
    $OUT .= "PFC=\$(/sbin/iptables --table nat ";
    $OUT .= "--numeric --list PortForwarding |\\\n";
    $OUT .= "   sed -n '3s/ .*//p')\n";
    $OUT .= "    /sbin/iptables --table nat --new-chain $pf_chain\n";
    my %tcp_forwards = split(/,/, $masq{TCPForwards} || '');
    foreach my $port (keys %tcp_forwards)
    {
        my ($ip, $dport) = split(/:/, $tcp_forwards{$port});
        $port =~ s/-/:/;
        $OUT .= "    /sbin/iptables --table nat --append $pf_chain " .
                "--protocol tcp \\\n".
        # Set up local port to forward
            "         --destination-port ${port} -j DNAT " .
        # Set up the remote port to forward to
                "--to-destination $ip";
        # Append the dport if any. 
        $OUT .= ":$dport" if $dport;
        $OUT .= "\n";
        # And accept the incoming packets. Use the dport if there is one.
        ($port = $dport) =~ s/-/:/ if $dport;
        $OUT .= "    adjust_tcp_in $port ACCEPT ForwardedTCP_\$\$ $ip/32\n";
    }
    my %udp_forwards = split(/,/, $masq{UDPForwards} || '');
    foreach my $port (keys %udp_forwards)
    {
        my ($ip, $dport) = split(/:/, $udp_forwards{$port});
        $port =~ s/-/:/;
        $OUT .= "    /sbin/iptables --table nat --append $pf_chain " .
                "--protocol udp \\\n" .
        # Set up local port to forward
                "--destination-port ${port} -j DNAT " .
        # Set up the remote port to forward to
                "--to-destination $ip";
        # Append the dport if any.
        $OUT .= ":$dport" if $dport;
        $OUT .= "\n";
        # And accept the incoming packets. Use the dport if there is one.
        ($port = $dport) =~ s/-/:/ if $dport;
        $OUT .= "    adjust_udp_in $port ACCEPT ForwardedUDP_\$\$ $ip/32\n";
    }

    # having created a new PortForwarding chain, activate it and destroy
    # the old.
    $OUT .= "    /sbin/iptables --table nat --replace PortForwarding 1 " .
                "--destination \$OUTERNET --jump $pf_chain\n";
    $OUT .= "    /sbin/iptables --table nat --flush \$PFC\n";
    $OUT .= "    /sbin/iptables --table nat --delete-chain \$PFC\n";
}
