How would you go about the following:
Note: Internet access should work at all times using the classic MASQUERADE action in the nat table's POSTROUTING chain.
Now the challenge:
- for all connections accessing the router (middle) from the outside (right) on a certain port (1)
- send those requests to the inside host (left) while making it appear the request came from the router (middle) (2)
- for the reply (3&4) inverse that process.
I don't know how you would call that specific method to NAT, and I don't know if it's possible at all (or with netfilter).
(Don't ask why. But if you do: it's got to do with the routing table at the 192.168.1.2 host, which doesn't have the default route on the interface that I'm showing here, yet I'd like to have it available from anywhere, and I believe this is the only way to do it; by mapping the internet access to a connection/network that is directly attached, therefore overriding the routing table. I hope.)
And remember: Internet access should keep working using classic masquerading.