After a reinstallation of iptables-persistent, this solution worked for me.
I think my script failed because of the -nat -mangle parameters.

Oh sorry, i mean in the shell:

$ sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 5223

if i check with

$ sudo iptables -t nat -L

they were applied.
I write them into a skript in /etc/network/if-pre-up.d/ but after a reboot its flushed.

#!/bin/sh
set -e
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 5223

Excuse me, I've been working with Devuan for less time, so it's a bit more complicated than systemd. However, I really wanted to get rid of systemd!
My intention is only to secure my ejabberd server against empd.

Thank you for your advice.

You mean I should move my script into the folder /etc/init.d? I have not quite understood the order and the dependencies?
In my script I'm just releasing ports.

Thank you for answering.

Thats the errormessage:

iptables: No chain/target/match by that name.
iptables: No chain/target/match by that name.
Bad argument ` '
Try `iptables -h' or 'iptables --help' for more information.
Bad argument ` '
Try `iptables -h' or 'iptables --help' for more information.

but if i type in every rule, there is no error. ??

The same skript runs finde on my debian/raspbian