/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 -d xxx.xxx.xxx.xxx --dport 80 -j DNAT --to 192.168.1.68:22

/sbin/iptables -A FORWARD -p tcp -i eth0 -d 192.168.1.68 --dport 22 -j ACCEPT

result of iptables -L -t NAT

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

DNAT tcp -- anywhere xxx.xxx.xxx.xxx. tcp dpt:www to:192.168.1.68:22

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination