SOLVED:
iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 --match multiport ! --dports 22,8000 -j DNAT --to-destination 2.2.2.2
I found the multiport option!! This works as expected.
I am using 8000 for web and 22 for SSH. I am trying to forward all but those two ports. The following forwards all but port 8000
iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 ! --dport 8000 -j DNAT --to-destination 2.2.2.2
I can forward all but a range with the following (all but 22 - 8000)
iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 ! --dport 22:8000 -j DNAT --to-destination 2.2.2.2
Using the following does not work
iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 ! --dport 22 -j DNAT --to-destination 2.2.2.2
iptables -A PREROUTING -t nat -p tcp -d 1.1.1.1 ! --dport 8000 -j DNAT --to-destination 2.2.2.2
I tried commas as well. Also tried searching for a bit with no luck. How can I forward all but 22 and 8000?