Just notes on how I manage my home server, some commands I found useful
Tried to solve this problem for a while, solution was VERY simple. Install iptables and enable it. Then just add the following rules:
iptables -A PREROUTING -t nat -i wlp2s0 -p tcp --dport 2222 -j DNAT --to-destination <vm-addr>:22
iptables -A FORWARD -p tcp -d <vm-addr> --dport 22 -j ACCEPT
# save rules
sh -c 'iptables-save > /etc/iptables/rules.v4' <vm-addr> is VM address. You can get it by running ip addr inside VM.
UPD: Better solution https://serverfault.com/questions/915257/ssh-port-forwarding-with-firewall-cmd