iptables 转发的问题

最近在研究@lifetyper FreeRouter_V2的翻墙方案，再本地机器中执行如下命令：
#1创建ipset 模块
ipset create ssh iphash -exist
#2目的地址匹配ipset给数据包打标记
iptables -t mangle -I PREROUTING -m set --match-set ssh dst -j MARK --set-mark 10
#3:添加策略路由(ip rule), 让它们走ssh 路由表
ip rule add fwmark 1 table ssh priority 1984
#4设置默认路由
ip route add default dev vpn0 table ssh

iptables -t nat -A POSTROUTING -o vpn0 -j MASQUERADE

173.194.127.76这个ip地址在ssh ipset模块中，但是：
mtr --report 173.194.127.76
HOST: doenx Loss% Snt Last Avg Best Wrst StDev
1.|-- 192.168.10.190 0.0% 10 170.7 145.7 126.8 170.7 13.4
2.|-- ??? 100.0 10 0.0 0.0 0.0 0.0 0.0
数据包只到达vpn服务器的网关，然后就无法转发了！！

vps中的iptables表：
[root@vps ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere

[root@vps ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 10.8.0.0/24 anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- 10.0.0.0/24 anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere
MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination


[root@vps ~]# ip route list
192.168.10.191 dev vpn0 proto kernel scope link src 192.168.10.190
128.199.128.0/18 dev eth0 proto kernel scope link src 128.199.189.120
169.254.0.0/16 dev eth0 scope link metric 1002
default via 128.199.128.1 dev eth0

@neroanelli @pheyx