Port forwarding with iptables not working anymore

Question

I installed SSH honeypot cowrie and configured real ssh to use a different port. The honeypot is supposed to use a port n. Iptables is configured to route traffic from port 22 to port %PORT:

iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port %PORT

Cowrie is just running fine, this works:

ssh root@localhost -p %PORT

What's not working is this:

ssh root@localhost

Same for remote connections (except, port %PORT is not working, because it's not opened.

ssh: connect to host localhost port 22: Connection refused

Real SSH itself is working pretty fine on it's secret port somewhere.

Those are the nat-rules from iptables:

Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination
1    REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:ssh redir ports %PORT

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Those are the global rules from iptables:

Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    f2b-dovecot-pop3imap  tcp  --  anywhere             anywhere             multiport dports pop3,imap2
2    f2b-sshd   tcp  --  anywhere             anywhere             multiport dports ssh
3    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
4    ACCEPT     all  --  anywhere             anywhere
5    ACCEPT     icmp --  anywhere             anywhere             icmp echo-request
[... removed some mappings not related to this toppics (http-specific, some mail-ports)]
15   ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:%REAL_SSH_PORT ctstate NEW,ESTABLISHED

Chain FORWARD (policy DROP)
num  target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Chain f2b-dovecot-pop3imap (1 references)
num  target     prot opt source               destination
1    RETURN     all  --  anywhere             anywhere

Chain f2b-sshd (1 references)
num  target     prot opt source               destination
1    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
2    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
3    REJECT     all  --  XXXXXXX  anywhere             reject-with icmp-port-unreachable
4    REJECT     all  --  XXXXXXX       anywhere             reject-with icmp-port-unreachable
5    RETURN     all  --  anywhere             anywhere

Some side-notes:

1. Choosing a different source port, like 99, will also not work

2. Using a local port forwarding rule like this works pretty fine when connecting from local machine

   iptables -t nat -A OUTPUT -p tcp --dport 22 -j REDIRECT --to-port %PORT
   

What am I not seeing here?

Answer 1

Thanks to @wurtel - PREROUTING does not imply opening a port. I also had to open the SSH-honeypots port like this:

iptables -A INPUT -p tcp --dport %PORT -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT