How to force a server on Debian to forward ports instead of a router?

Question

linux

Hello!
The network diagram is banal:
Internet <-> router <-> LAN
In a LAN server with several virtual machines that have a network bridge to the router, i.e. virtual machines seem to be connected directly to the router.
IP addresses of machines on the network:

Физ. сервер     192.168.1.20    (Proxmox 3.3)
– openvz 100    192.168.1.200   (Debian 7, используется как WEB-сервер)
– openvz 101    192.168.1.201   (Debian 7, используется как FTP-сервер)
– openvz 102    192.168.1.202   (Debian 7, предполагается использовать вместо NAT'а роутера)

Port forwarding (NAT) is now configured on the router:

*:22 -> 192.168.1.20:22
*:80 -> 192.168.1.200:80
*:21 -> 192.168.1.201:21

Now I want to forward all ports to the virtual server, and force it to decide what to do.
The router will receive the following settings:
*:* -> 192.168.1.202:*
Question: how to properly configure the server "102" for redirection, what should be installed and how to configure?
I also want to have such a possibility of redirection on the server:

test.ru:80      -> 192.168.1.200:80
test.ru:22      -> 192.168.1.20:22
test.ru:3022    -> 192.168.200:22
demo.ru:80      -> 192.168.1.1:80
*:21            -> 192.168.1.201:21

where test.ru and demo.ru both point to the router's global IP.

Answer 1

test.ru:80 -> 192.168.1.200:80
demo.ru:80 -> 192.168.1.1:80

different domains...
this trick will not work with regular DNAT
, you need something smarter (for example, using nginx)
the rest with iptables rules

iptables -t nat -A PREROUTING -d 192.168.1.202 -p tcp -m tcp --dport 3022 -j DNAT --to-destination 192.168.1.200:22
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -d 192.168.1.200 -p tcp -m tcp --dport 22 -j ACCEPT

further by analogy