iptables -t nat seems not working properly

I'm working on Ubuntu 20.04. I set the following iptables rules:

sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --dport 445 -j DNAT --to-destination 192.168.10.162:445

There 192.168.10.162 is another Ubuntu server of 18.04 running some smb server also.

When I run $sudo iptables -t nat -L -v, it shows the following:

Chain PREROUTING (policy ACCEPT 3 packets, 249 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds to:192.168.10.162:445

Chain INPUT (policy ACCEPT 1 packets, 149 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  any    any     anywhere             192.168.10.162

It means my nat commands has taken effects, right? And it means the packets to 445 (smb) port will be forwarded to 192.168.10.162:445, right?

I enabled ip forward by $sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward. I installed a smb server on the Ubuntu 20.04 machine and use another Win10 PC to access the shared directory of it. Then I found my visits, delete of files under the directory, or copy of files to the directory, shows no signs of records on the two nat rules I added.

And then after I mount the smb shared directory of 192.168.10.162 on the Ubuntu 20.04 machine, and visit its own smb shared directory as above, it still shows no sign of records in the PREROUTING rule but some in the POSTROUTING rule.

Chain PREROUTING (policy ACCEPT 176 packets, 16007 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:microsoft-ds to:192.168.10.162:445

Chain INPUT (policy ACCEPT 74 packets, 10704 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 19 packets, 1620 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 18 packets, 1560 bytes)
 pkts bytes target     prot opt in     out     source               destination
    1    60 MASQUERADE  all  --  any    any     anywhere             192.168.10.162

It seems maybe the mount command triggered the record on my POSTROUTING rule. And I also tested that ping to 192.168.10.162 triggered records on this rule. But why there is no pkts or bytes captured on my PREROUTING rule? Even I copy a large file to the smb shared directory of the Ubuntu 20.04 machine.

[Update] I tried forwarding all packets with dport of 8080 to 192:168.10.162:80 running a web server. Then I use a Win10 PC to visit the machine (Ubuntu 20.04) via http://[ip address]:8080, it redirects to the web server. And iptables nat PREROUTING and POSTROUTING shows records.

Chain PREROUTING (policy ACCEPT 551 packets, 41812 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   260 DNAT       tcp  --  any    any     anywhere             anywhere             tcp dpt:http-alt to:192.168.10.162:80

Chain INPUT (policy ACCEPT 77 packets, 10563 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 12 packets, 922 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 12 packets, 922 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   260 MASQUERADE  tcp  --  any    any     anywhere             192.168.10.162       tcp dpt:http

[Update] I use $tcptrack to confirm that the packets did sent to the 445 port of Ubuntu 20.04. Again no packets were shown captured by nat PREROUTING.

You're trying SMB server, but you didn't DNAT all the SMB-replated ports. You also need these ports as well: 137,138,139

You can see a nice table on the ports and their corresponding TCP/UDP protocol here.

sudo iptables -t nat -A POSTROUTING -d 192.168.10.162 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -m multiport --dports 137,138,139,445 -j DNAT --to-destination 192.168.10.162

Of course the second rule doesn't chek the correct TCP/UDP protocol for each port.

If you want your tables to work for this machine as well as the ones that this machine routes, then you have to do the same for the OUTPUT chain as well as the PREROUTING chain:

sudo iptables -t nat -A OUTPUT -m multiport --dports 137,138,139,445 -j DNAT --to-destination 192.168.10.162

This is because the packets that are generated from your own machine, don't go through the PREROUTING and go straight to the OUTPUT and then to the POSTROUTING.

Here's a diagram from nftables' hooks than can help you out in understanding this:

I'm sorry to tell you all that I made a low-level mistake. I forgot to enable IPFORWARD in the Linux machine. After I run

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

It works.