iptables -t nat -A PREROUTING -i br0 -s ! 192.168.3.3 -p tcp --dport 80 -j DNAT --to 192.168.3.3:3128
iptables -t nat -A POSTROUTING -o br0 -s 192.168.3.0 -d 192.168.3.3 -j SNAT --to 192.168.3.254
iptables -A FORWARD -s 192.168.3.0 -d 192.168.3.3 -i br0 -o br0 -p tcp --dport 3128 -j ACCEPT