iptables is legacy now and if you're not already well-versed in it, better go straight to nftables (which should be easier to get started with anyway). On modern systems, iptables commands are translated to nftables equivalents by transitional package.
Is there a way to be selective about what ports are exposed from the host to the target? The target could handle it but fine grained control is nice.