Не делает SNAT после DNAT iptables.

iptables -t raw -A PREROUTING -p tcp --dport 8000 -s 192.168.1.2 -j TRACE

TRACE: raw:PREROUTING:rule:3 IN=br-lan OUT= PHYSIN=eth0 MAC=00:d0:b4:02:84:6a:fa:19:87:f0:44:2a:08:00 SRC=192.168.1.2 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=24484 DF PROTO=TCP SPT=60378 DPT=8000 SEQ=2508694540 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B40402080A34066BD1000000000103030A)

...

TRACE: mangle:PREROUTING:rule:2 IN=br-lan OUT= PHYSIN=eth0 MAC=00:d0:b4:02:84:6a:fa:19:87:f0:44:2a:08:00 SRC=192.168.1.2 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=24484 DF PROTO=TCP SPT=60378 DPT=8000 SEQ=2508694540 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B40402080A34066BD1000000000103030A) MARK=0x3f00

...

TRACE: nat:PREROUTING:rule:2 IN=br-lan OUT= PHYSIN=eth0 MAC=00:d0:b4:02:84:6a:fa:19:87:f0:44:2a:08:00 SRC=192.168.1.2 DST=192.168.1.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=24486 DF PROTO=TCP SPT=60378 DPT=8000 SEQ=2508694540 ACK=0 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (020405B40402080A3406779F000000000103030A) MARK=0x3f00

tcpdump: data link type LINUX_SLL2
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes

17:50:42.353685 eth0  P   IP 192.168.1.2.57132 > 192.168.1.1.8000: Flags [S], seq 3505131552, win 65535, options [mss 1460,sackOK,TS val 873934940 ecr 0,nop,wscale 10], length 0
17:50:42.409810 br-lan Out IP 192.168.1.2.57132 > 192.168.1.20.8000: Flags [S], seq 3505131552, win 65535, options [mss 1460,sackOK,TS val 873934940 ecr 0,nop,wscale 10], length 0

#!/usr/bin/env perl
use strict;

my @R;
open(F,$ARGV[0] ? '<'.$ARGV[0] : "dmesg|") || die;
while(<F>) {
        next if !/TRACE:/;
        chomp; s/^\[\s+/[/;
        push @R,[grep !/^(TOS=|PREC=|MAC=|TRACE:)/, split /\s+/];
}
close(F);

my $LL = $R[$#R];
die if !$LL;
die $LL->[0] if $LL->[0] !~ /^\[\s*(\d+)\.\d+\]$/;
my $st = 0;
my @PX;
foreach my $L (@R) {
        next if !$st && $L->[1] !~ /^raw/;
        $st = 1;
        @PX = () if $L->[1] =~ /^raw/;
        my @t = splice(@$L,0,2);
        foreach my $i (@$L) {
                my $x = 0; map {$x = 1 if $i eq $_} @PX;
                if(!$x) {
                        push @PX,$i; push @t,$i;
                }
        }
        print join(" ",@t),"\n";
}

# Generated by iptables-save v1.8.10 on Thu Mar  6 15:54:57 2025
*raw
:PREROUTING ACCEPT [405699954:431951238193]
:OUTPUT ACCEPT [7093:1386970]
-A PREROUTING -s 10.200.2.252/32 -p tcp -m tcp --dport 8022 --tcp-flags FIN,SYN,RST,ACK SYN -j TRACE
COMMIT
*nat
:PREROUTING ACCEPT [12995886:1826359846]
:INPUT ACCEPT [11231:3249909]
:OUTPUT ACCEPT [56:3795]
:POSTROUTING ACCEPT [3469884:388479430]
-A PREROUTING -s 10.200.2.252/32 -p tcp -m tcp --dport 8022 -j DNAT --to-destination 10.200.2.2:22
-A POSTROUTING -s 10.200.2.252/32 -d 10.200.2.2/32 -j SNAT --to-source 10.200.2.11
COMMIT
*filter
:INPUT ACCEPT [100940:18331163]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [87750:29098658]
-A FORWARD -s 10.200.2.0/24 -d 10.200.2.0/24 -j ACCEPT
COMMIT

[13684.134473] raw:PREROUTING:policy:3 IN=vlan0022 OUT= SRC=10.200.2.252 DST=10.200.2.11 LEN=60 TTL=64 ID=47815 DF PROTO=TCP SPT=50934 DPT=8022 SEQ=3472755009 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B40402080A774E41420000000001030307)
[13684.134491] nat:PREROUTING:rule:1
[13684.134531] filter:FORWARD:rule:1 OUT=vlan0022 DST=10.200.2.2 TTL=63 DPT=22
[13684.134538] nat:POSTROUTING:rule:1