I have an SSH server on a private subnet within an EC2 vpc listening for ssh on port 9022

I also have a nat instance (standard Amazon EC2 nat) on a public instance. I would like to forward incoming SSH connections (port 9022) to my nat to the internal server (port 9022).

I tried this, but it didn't work:

sudo iptables -t nat -I PREROUTING -p tcp -i eth0 --dport 9022 -j DNAT --to-destination 10.0.2.11:9022

I verified that 10.0.2.11 is listening on port 9022. (I can telnet). I verified my security group allows incoming port 9022. I verified that /proc/sys/net/ipv4/ip_forward is 1.

What am I missing?

Edit:

Turns out this was correct after all. I had a mistake in my security group.