Regarding port forwarding

[averagePedestrian]

A high-level overview of what I wanted to accomplish: I am currently behind a CGNAT. The VPS(Outside my home network), where I have installed PiVPN, has a static IPv4 address. I am trying to forward the port that qbittorrent is using on my pc. I am doing this to become connectable to others which in turn would increase my upload speeds.

Some info:

OS and Network info:
OS running on VPS: Ubuntu 22.04.4 LTS
OS running on PC: WIndows 10
VPS public ip: 1.2.3.4
WireGuard interface: wg0
IPv4 address for wg0: 10.221.178.1
Network adapter on VPS: enp0s6
IPv4 address for enp0s6: 10.0.0.18
Port used for incoming connections on qbittorrent: 32554

Iptables rules on the server: https://rentry.co/pniz3pkn

Wireguard Config
::::  Server configuration shown below   ::::
[Interface]
PrivateKey = server_priv
Address = 10.221.178.1/24,fd11:5ee:bad:c0de::1/64
MTU = 1420
ListenPort = 51820
### begin zephyrus-m ###
[Peer]
PublicKey = zephyrus-m_pub
PresharedKey = zephyrus-m_psk
AllowedIPs = 10.221.178.2/32,fd11:5ee:bad:c0de::2/128
### end zephyrus-m ###
=============================================
::::  Client configuration shown below   ::::
[Interface]
PrivateKey = zephyrus-m_priv
Address = 10.221.178.2/24,fd11:5ee:bad:c0de::2/64
DNS = 10.221.178.1

[Peer]
PublicKey = server_pub
PresharedKey = zephyrus-m_psk
Endpoint = REDACTED:51820
AllowedIPs = 0.0.0.0/0, ::0/0

I tried the following with no luck:

iptables -t nat -A PREROUTING -i enp0s6 -p tcp --dport 32554 -j DNAT --to-destination 10.221.178.2
iptables -t nat -A POSTROUTING -p tcp --dport 32554 -d 10.221.178.2 -j MASQUERADE

Then I finally managed to get it working. When I installed PiVPN, it created the following rules in the Forward chain

Chain FORWARD (policy ACCEPT)
num target   prot opt source        destination     
1  ACCEPT   all -- anywhere       10.221.178.0/24   ctstate RELATED,ESTABLISHED /* wireguard-forward-rule */
2  ACCEPT   all -- 10.221.178.0/24   anywhere       /* wireguard-forward-rule */
3  REJECT   all -- anywhere       anywhere       reject-with icmp-host-prohibited

The first rule was preventing me from getting port forwarding to work, despite numerous attempts. However, after modifying this rule to:

1. ACCEPT all -- anywhere 10.221.178.0/24

port forwarding started functioning correctly. As I am just a beginner, could anyone explain what is happening here? Would this modification cause any issue? Everything seems to be working, but since PiVPN initially set it up that way, there must be a reason for it. Therefore, I’m hesitant about making changes.