Connection tracking is not necessary to redirect a port. You just need to change the address in both directions, i.e. one -j DNAT
rule and another -j SNAT
rule. You should also specify the input and output interface with the -i
and -o
options as appropriate. I’m sure there are plenty examples out there.
EDIT: Hm, per this post it is really not supposed to work. I probably confused it with something else.