iptables = route forwarded ports, DNAT + MASQUERADE

#(anything arriving into the box on dport #x, gets NAT'ed over to the local lan IP, same port. then masquerade needed.)

#example one.
sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 32401 -j DNAT --to-destination 192.168.0.200:32401
sudo iptables -t nat -A POSTROUTING -p tcp -m tcp -d 192.168.0.200 --dport 32401 -j MASQUERADE
#example two.
sudo iptables -t nat -A PREROUTING -p tcp -m tcp --dport 1025 -j DNAT --to-destination 10.0.8.1:1025
sudo iptables -t nat -A POSTROUTING -p tcp -m tcp -d 10.0.8.1 --dport 1025 -j MASQUERADE