if you need to do only to perform a DNAT, the rule that you have placed in POSTROUTING is not necessary (so you can remove it), the SNAT rule is necessary in case of full NAT.
About your DNAT rule this is wrong because in the parameter --dport you need to place the port that you call from the outside of the Server A (9443).
So the right rule would be this:
iptables -t nat -A PREROUTING -d 10.10.8.33/32 -p tcp -m tcp --dport 9443 -j DNAT --to-destination 10.21.2.31:443
@Sandy your question it's not so clear.. So I hope to have understand properly what you want to accomplish.
Just to recap what you want to and what are the issues:
- Reach the Server B from the PC C passing through Server A by calling it on port TCP 9443 (DNAT rule from 9443 to 443)
- Server B and PC C are in the same subnet
- Since Server B and PC C are in the same subnet the DNAT itself is not working because the Server B reply directly to the PC C and this is why you need an SNAT rule
So the previous DNAT that I have proposed should be correct but you need also to masquerade (with SNAT) the request coming from PC C with the IP of the Server A.
The SNAT rule for masquerade the request from PC C should be:
iptables -t nat -A POSTROUTING -s 10.21.2.93/32 -d 10.21.2.31/32 -p tcp -m tcp --dport 443 -j SNAT --to-source 10.10.8.33
The network topology is that one in the picture? If this is the topology (or pretty similar) there is a particular reason for using iptables instead of implementing an Apache, nginx or HAProxy as a reverse proxy?