Hi everyone.

I currently have a couple of servers at home sitting on a consumer type DSL with 1 static IP which terminates to a Linux gateway.

To this I've a domain which points to my gateway.
Example: example.com points at 123.123.123.123

What I'm trying to achieve is the following:
Example: host1.example.com points at 123.123.123.123

If host-request is host1.example.com, forward traffic to 192.168.1.4

I've tried to do this using:
iptables -t nat -A PREROUTING -d host1.example.com -j DNAT --to-destination 192.168.1.4

but it wont do the trick.

Please advice.

If your home static IP is 123.123.123.123, then all unicast traffic that gets to that gateway will have that same destination IP. The only way to distinguish between the hosts to which specific packets should be redirected would be by port number. Even though you may have multiple DNS records 'pointing' to the same IP, any reference to those IP names is lost once the packet has been sent. There is no name content in the packet in transit, only the actual numeric address.
With respect to your iptables rules, you would need to add a rule that actually does the forwarding of the packet. Your rule should be good for translating the packet into one that would find its way to the intended host, but you need a FORWARD rule to actually get it sent. Something like:
This example uses port 80, assuming your server is an HTTP server. You might need to add a parameter about what interface the original packet came from.
--- rod

Are you sure that the "IP name" is lost. If you're using virtual hosts with apache it's able to distinguish the names properly, is it that iptables is unable to do this?

Okay, we're both right. After a short experiment with wireshark, I see that at the pure TCP level, where iptables does its work, there is no name information in the packet. For an HTTP request packet, there is a header in the data frame of the packet which identifies the host by name, called the "Host:" header. That would be what allows a web server to host multiple virtual servers. I always wondered about that.
--- rod.

So final verdict is that I'm SOL for this solution, guess I'll have to go with SSH tunneling instead.

Thanks