#!/usr/bin/env bash
UPLINK_INTERFACE="enp0s31f6"

for port in {4010..4200}; do
    ip_octet=$((port - 4000))               # 4011 → 11, … 4200 → 200
    dst_ip="192.168.0.${ip_octet}"

    iptables -t nat -A PREROUTING \
        -i "$UPLINK_INTERFACE" -p tcp -m tcp --dport "$port" \
        -j DNAT --to-destination "${dst_ip}:22"
done
iptables -t nat -A POSTROUTING     -o br-ext -p tcp -d 192.168.0.0/24 --dport 22     -j MASQUERADE