How to forward traffic from one server to another?

Question

linux

Good day.
Faced the following problem - it is necessary to forward traffic from port 80 of one server (hereinafter 1.1.1.1) to another (hereinafter 2.2.2.2). Both servers are hosted on amazon, the OS is the eighth debian on the first and bubunta 14.04 on the second.
I did this via iptables:

# sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf # включил ip forwarding
# sysctl -p // проверил, включилось
# iptables -F // удалил текущие правила
# iptables -t nat -F // и специально для nat
// Далее сами правила 
# iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 2.2.2.2:80
# iptables -t nat -A POSTROUTING -p tcp -d 2.2.2.2 --dport 80 -j SNAT --to-source 1.1.1.1
# sudo iptables -t nat -L -n // проверка
// вывод:
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to: 2.2.2.2:80
 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
 
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       tcp  --  0.0.0.0/0             2.2.2.2      tcp dpt:80 to: 1.1.1.1
// и напоследок сохранил и проверил:
# iptables-save | sudo tee /etc/iptables.up.rules

Tcpdump on the first machine shows that the packet is sent to the second host, but on the second host it is either not processed or it is cut by Amazon's nat. Googling and communication with the admins did not help, everyone got even more confused. The maximum that was achieved was sending packets to the second host when accessing the first one, but they are not processed there, there is no output in tcpdump.
If someone wants to suggest Port mirroring or mangle in iptables - in principle it is considered.
Thanks in advance.

Answer 1

Do you allow this traffic in the security group for instance 2?

Answer 2

Judging by the fact that there is only one port, 80, it is probably about web traffic, and if not encrypted, then you can simply use the standard nginx or apache scanning modules:
. . .
location / {
proxy_pass http://2.2.2.2:8080;
. . .