How to forward IPsec traffic to another subnet?

Question

iptables

Greetings, dear community, there are
three network cards on the server:
red0 - external
orange0 - dmz
green0 -
ipsec locale is built through an external card on dmz. Everything works well, then with the rules I forward packets from local to ipsec:

iptables -t NAT -I POSTROUTING -d 192.168.80.0/24 -j SNAT --to-source 172.16.10.254
iptables -I FORWARD -s 192.168.80.98 -j ACCEPT
iptables -I FORWARD -d 192.168.80.98 -j ACCEPT

everything that goes from LAN to ipsec passes remarkably. Now there is a need to allow mongo synchronization from ipsec to local. But I can't write the necessary rules. Please help.
Need to use PREOROUTING?
Thank you very much in advance!

Answer 1

The rule solved the problem:

iptables -t nat -A PREROUTING -p tcp -d 172.16.10.254 --dport 27017 -j DNAT --to-destination 192.168.5.237:27017