Given that the two routers allow all connections to pass from either side the simplest thing is to add new IP addresses to the two interfaces of DEV2. We do this so that DEV2 can easily distinguish between packets meant for it, and packets meant to go through:
ip addr add 192.168.2.3/24 dev INTERFACE2
ip addr add 10.12.0.218/24 dev INTERFACE3
(substitute the real interfaces names for INTERFACE2/3, and make sure that these addresses are not taken, to do so just ping -c 192.168.2.3 for instance and see whether you get any reply. Also, I guessed the two masks are /24, if not please adjust accordingly). Now anything for 192.168.2.3 and 10.12.0.218 is for DEV1/3, while anything for 192.168.2.1-10.12.0.217 is for DEV2.
Now we forward anything arriving on the two new addresses:
iptables -A FORWARD -j ACCEPT
iptables -A PREROUTING -t nat -d 192.168.2.3 -j DNAT --to 10.10.3.154
iptables -A PREROUTING -t nat -d 10.12.0.218 -j DNAT --to 192.168.2.2
iptables -t nat -A POSTROUTING -j MASQUERADE
The first rule allows packets to migrate from one interface to the other (the rule net.ipv4.ip_forward = 1 is necessary but not sufficient), the last rule rewrites all packet headers as if coming from the outgoing interface so that replies are again routed thru DEV2; the two rules in between rewrite the packet headers so that packets are sent from DEV1 to DEV3 (rule n.2) and from DEV3 to DEV1 (rule n.3).
The advantage of this setup is that it is clean: all protocols, and all ports are routed simultaneously, without any need to add unnecessary complications.
CAVEAT: interface1 on DEV1 and interface2 on DEV2 belong to the same subnet, which is strange since you say that the two are separated by a router: by definition, a router joins two distinct subnets. So, either router1 is not a router, or, if it is, there is an error in its configuration since it is surrounded by the same networks on both sides. I have assumed the former, not the latter.