$IPTABLES -A PREROUTING -t nat -p tcp -i eth1 -d 200.xxx.xxx.xxx --dport 3389 -j DNAT --to 192.168.1.20:3389
$IPTABLES -A FORWARD -p tcp -i eth1 -d 192.168.0.20 --dport 3389 -j ACCEPT


eth1 = placa ligada ao modem
200.xxx.... = ip valido internet
192.168.0.20 = maquina onde ta o terminal service
3389 = porta terminal service