IPTABLES NAT

192.168.1.20 lan sort sur internet par le wan xxx.xxx.xxx.xxx
iptables -t nat -A POSTROUTING -s 192.168.1.20/32 -o eth0 -j SNAT --to-source xxx.xxx.xxx.xxx

"xxx.xxx.xxx.xxx:3333 -> 192.168.1.12:3389
iptables -t nat -A PREROUTING -d xxx.xxx.xxx.xxx/32 -i eth0 -p tcp -m tcp --dport 3333 -j DNAT --to-destination 192.168.1.12:3389


"xxx.xxx.xxx.xxx -> plage de port
iptables -t nat -A PREROUTING -d xx.xxx.xxx.xxx/32 -i eth0 -p udp -m udp --dport 10000:20000 -j DNAT --to-destination 192.168.1.11:10000-20000

PROXMOX lan

# network interfaces
#/etc/network/interfaces
auto lo
iface lo inet loopback
    
iface eno1 inet static
    
auto vmbr0
iface vmbr0 inet static
#adresse publique
address xxx.xxx.xxx.xxx  
gateway xxx.xxx.xxx.254
broadcast xxx.xxx.xxx.255
netmask 255.255.255.0
bridge-ports eno1
bridge-stp off
bridge-fd 0
    
	
auto vmbr1
iface vmbr1 inet static
address 192.168.2.254
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
	  
	  
post-up   echo 1 > /proc/sys/net/ipv4/ip_forward
# 3333-> 3389 de la VM en 192.168.2.10
post-up  iptables -t nat -A PREROUTING -p tcp -i vmbr0 --dport 3333 -j DNAT --to-destination 192.168.2.10:3389

# annulation 
#post-down iptables -t nat -D PREROUTING -p tcp -i vmbr0 --dport 3333 -j DNAT --to-destination 192.168.2.10:3389
	
# la VM peux sortir sur internet  
#iptables -t nat -A POSTROUTING -s 192.168.2.10/32 -o vmbr0 -j SNAT --to-source xxx.xxx.xxx.xxx
Annulation
#iptables -t nat -D POSTROUTING -s 192.168.2.10/32 -o vmbr0 -j SNAT --to-source xxx.xxx.xxx.xxx


iptables -t nat -L -n -v