Port Forwarding

Masquerade :
/sbin/iptables -t nat -A POSTROUTING -o xenbr0 -j MASQUERADE

Port Forwarding :
  iptables -t nat -A PREROUTING -p tcp -s 0.0.0.0/0 -d  10.228.1.120  --dport 2221 -j DNAT --to-destination 192.168.1.1:22

Note : In this case Xenbr0 is listening externally. 

Anyone connecting to hypervisor on 10.228.1.120:2221 will be forwarded to VM 192.168.1.1:22