Enable VPN port forwarding

sudo iptables -t nat -A PREROUTING -d 217.154.59.19 -p tcp --dport PORT:PORT -j DNAT --to-destination 10.8.0.2:PORT-PORT
sudo iptables -A FORWARD -p tcp -d 10.8.0.2 --dport PORT:PORT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -d 10.8.0.2 -p tcp --dport PORT:PORT -j MASQUERADE
sudo apt update
sudo apt install iptables-persistent
sudo iptables-save | sudo tee /etc/iptables/rules.v4

  ## Prerequisites
Replace the following placeholders with your actual values:
* **`1.2.3.4`**: Your VPS public IP address.
* **`10.8.0.2`**: Your home server's internal VPN IP address.
* **`6000:7000`**: The range of ports you want to forward.

---

## Step 1: Enable IP Forwarding Permanently
Open the configuration file with a text editor:
```bash
sudo nano /etc/sysctl.conf
```

Find the line `#net.ipv4.ip_forward=1` and remove the hashtag (`#`) to uncomment it. If the line is missing entirely, add it to the bottom of the file:
```text
net.ipv4.ip_forward=1
```

Save and exit the file (`Ctrl+O`, `Enter`, `Ctrl+X`). Apply the changes immediately without rebooting:
```bash
sudo sysctl -p
```

---

## Step 2: Apply the TCP iptables Rules
Run these three commands on your VPS to handle the routing, firewall allowance, and NAT masquerading:

```bash
# 1. Forward the incoming TCP port range to your home server's VPN IP
sudo iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp --dport 6000:7000 -j DNAT --to-destination 10.8.0.2:6000-7000

# 2. Allow the TCP traffic through the FORWARD chain
sudo iptables -A FORWARD -p tcp -d 10.8.0.2 --dport 6000:7000 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

# 3. Masquerade the traffic so the home server forces replies back through the VPN tunnel
sudo iptables -t nat -A POSTROUTING -d 10.8.0.2 -p tcp --dport 6000:7000 -j MASQUERADE
```

> **Note on Syntax:**
> * In the `--dport` match flag, the port range uses a colon (`6000:7000`).
> * In the `--to-destination` target flag, the port range uses a dash (`6000-7000`).

---

## Step 3: Save the Rules Permanently
Debian clears `iptables` rules upon reboot. Use `iptables-persistent` to make them stick:

1. Install the persistent utility package:
   ```bash
   sudo apt update
   sudo apt install iptables-persistent
   ```
   *During the installation prompt, select **Yes** to save the current IPv4 rules.*

2. If you modify or add rules in the future, save the new configuration manually by running:
   ```bash
   sudo iptables-save | sudo tee /etc/iptables/rules.v4
   ```