port forwarding

# pinholes go in *nat table before its COMMIT!

# NAT pinhole: HTTP from WAN to LAN

-A PREROUTING -p tcp -m tcp -i p4p1 --dport 80 -j DNAT --to-destination 192.168.99.100:80