Aqui estão as regras que uso para encaminhar.
# Preroute the wan packet to your local network
iptables -t nat -A PREROUTING -i vlan1 -p tcp --dport <wan_port> -j DNAT --to-destination <lan_ip>:<lan_Port>
# Accept the packet through the forward filter
iptables -t filter -A FORWARD -i vlan1 -d <lan_ip> -p tcp --dport <lan_port> -j ACCEPT
# If you are using a UDP port, change the above tcp -> udp