iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To let a private IPv4 subnet reach the internet through a Linux gateway, enable IPv4 forwarding and add a narrowly scoped source NAT rule to the nat table’s POSTROUTING chain. With a fixed public address, use SNAT --to-source; when the egress address changes, use MASQUERADE. NAT alone is not a permission rule, so the filter table’s FORWARD policy, return routing, connection state, and rule persistence must also be correct.
What SNAT does and where the rule belongs
Source Network Address Translation (SNAT) rewrites the source address of packets leaving a Linux router. A client can keep using a private address such as 192.0.2.25, while internet hosts see the gateway’s address, such as 198.51.100.10. Connection tracking records the translation so replies can be mapped back to the original client and delivered through the gateway.
SNAT is configured in iptables’ nat table, normally in POSTROUTING, after the kernel has selected an outgoing route. The iptables-extensions documentation states: "This target is only valid in the nat table, in the POSTROUTING and INPUT chains, and user-defined chains which are only called from those chains." The Netfilter HOWTO uses the same pattern: -t nat -A POSTROUTING ... -j SNAT --to-source ....
The target is evaluated for the first packet of a connection. Once a translation is established, later packets in that connection use the recorded mapping rather than repeatedly creating a new NAT decision. A matching SNAT target also ends further rule examination for that packet in the chain. This is why changing a rule usually affects new connections first; already established flows can retain their existing mapping.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Before you change the firewall
Map the interfaces and addresses
Write down which interface faces the private network, which interface leads to the upstream router or ISP, the private source subnet, and the address that should appear on outgoing traffic. For example:
| Role | Example | What to confirm |
|---|---|---|
| Private subnet | 192.0.2.0/24 |
Clients actually use this network and their default gateway is the Linux server. |
| Egress interface | eth0 |
This is the interface whose packets leave toward the upstream network. |
| Fixed translated address | 198.51.100.10 |
The address is assigned to the server or delegated for its use by the upstream network. |
The addresses above are documentation examples. Replace them with values assigned in your environment; do not copy them into production. Confirm interface names with your distribution’s network tools and verify that the proposed public address is actually usable on the egress link.
Also record whether the server has more than one upstream interface, whether several private networks share the gateway, and whether only internet-bound traffic should be translated. These details determine how narrowly the rule should match. A rule that names one source prefix and one egress interface is safer than a catch-all rule on every routed packet.
Check the gateway role
- The server needs one reachable interface on the private network and one on the upstream network.
- Private clients must route their non-local traffic to this server.
- The upstream router must be able to return traffic to the translated address, either because that address is directly connected or because a route points back to this gateway.
- You need administrative privileges to change sysctl settings and iptables rules.
- Confirm the test client is using IPv4. An IPv4 iptables SNAT rule does not translate an IPv6 flow.
Enable IPv4 forwarding
NAT does not turn a host into a router by itself. The kernel must be allowed to forward IPv4 packets between interfaces. Red Hat’s firewall guidance includes net.ipv4.ip_forward=1 as part of an IPv4 NAT setup.
Enable it immediately
sudo sysctl -w net.ipv4.ip_forward=1Check the resulting value:
sysctl net.ipv4.ip_forwardThe expected output contains net.ipv4.ip_forward = 1. This runtime change normally lasts until reboot. Enabling it before adding NAT makes testing clearer: if forwarding is still disabled, a correctly written SNAT rule cannot make the gateway route packets.
Make forwarding persistent
Add the following setting to the persistent sysctl configuration supported by your distribution, then reload that configuration with its documented sysctl mechanism:
Recommended Free Tools
net.ipv4.ip_forward = 1Distributions differ in which file is preferred and how firewall state is restored. Use the host’s supported configuration method rather than assuming that a particular service or file exists everywhere. After a reboot, verify the value again before diagnosing NAT. A restored NAT rule with forwarding set back to zero still leaves clients unable to traverse the gateway.
Configure SNAT for a stable public address
For the example topology, the fixed-address rule is:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
sudo iptables -t nat -A POSTROUTING
-s 192.0.2.0/24 -o eth0
-j SNAT --to-source 198.51.100.10Substitute your real subnet, egress interface, and translated address. The rule’s parts have distinct jobs:
| Part | Purpose |
|---|---|
-t nat |
Selects the NAT table, where address translation targets are defined. |
-A POSTROUTING |
Appends the rule after route selection, just before the packet leaves. |
-s 192.0.2.0/24 |
Limits translation to packets sourced by the private subnet. |
-o eth0 |
Limits translation to traffic leaving the intended upstream interface. |
-j SNAT |
Invokes source NAT. |
--to-source 198.51.100.10 |
Sets the source address visible on the upstream network. |
Matching both the source network and egress interface is important. A broad rule that translates every source on every interface can alter traffic between internal networks, management paths, VPNs, or other uplinks. Add protocol, destination, or port matches only when the policy requires them. For example, a design that should translate only traffic toward one external service can include a destination match rather than translating all traffic from the subnet.
Free tools Windows power users keep installed
One-click scans. No signup required.
Make sure the address in --to-source is stable and valid for the outgoing path. Hard-coding an address that is not assigned, not routed back, or no longer belongs to the link can produce apparently successful local rule matches but unusable connections. If a provider delegates a block, choose the specific address that the upstream network expects this gateway to use.
Optional source-port ranges
For supported protocols, iptables can translate the source port as well as the address. A range may be attached to the source address, for example:
--to-source 198.51.100.10:40000-50000Use a port range only when you have a deliberate allocation requirement and have confirmed that it is valid for the protocol and iptables version in use. The iptables extensions documentation also describes randomization flags for supported protocols; these affect port selection, not the basic address-selection decision. Avoid adding them merely to make a rule look more secure. An unnecessarily narrow range can also limit the number of simultaneous translated flows.
Use MASQUERADE when the egress address changes
When the upstream interface receives a dynamic address, use:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo iptables -t nat -A POSTROUTING
-s 192.0.2.0/24 -o eth0
-j MASQUERADEMASQUERADE obtains the address of the outgoing interface at translation time. The Debian nftables manual describes it this way: "The masquerade statement is a special form of snat which always uses the outgoing interface’s IP address to translate to." This makes it suitable for DHCP, dial-up, and other links where the address can change.
| Situation | Preferred target | Reason |
|---|---|---|
| Stable, explicitly assigned public address | SNAT --to-source address |
The translation is explicit and tied to the known address. |
| Address assigned dynamically to the egress interface | MASQUERADE |
The current interface address is selected automatically. |
Using MASQUERADE for a permanently fixed address may still function, but explicit SNAT communicates the intended design and avoids treating a static link as dynamic. Conversely, hard-coding SNAT to an address that can change leaves new connections with an obsolete translation until the rule is changed. Existing sessions can also fail when a dynamic address changes because their connection mappings contain the old address; clients generally need to establish fresh connections.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Allow the traffic in the filter table
The NAT rule changes addresses; it does not grant forwarding permission. A server with a restrictive filter-table policy can count packets in POSTROUTING while still dropping the forwarded flow.
Review the active FORWARD policy in the firewall system your distribution uses. Permit only the traffic that should cross from the private interface to the egress interface, and allow the corresponding established return traffic according to your policy. The exact commands vary between direct iptables administration and distribution firewall managers, so do not copy a universal filter rule without checking your existing policy.
- Confirm the forward path from the private interface to the egress interface is permitted.
- Confirm return packets are accepted as part of established connections.
- Do not replace a restrictive policy with an unrestricted accept rule just to test NAT.
- Keep management access on an explicitly permitted path so a firewall change does not lock you out.
- Check both interface direction and source scope; permitting the wrong direction can leave outbound traffic blocked or expose an unintended path.
Persist the configuration safely
An interactive iptables command changes the running firewall; it does not guarantee that the rule will return after a reboot. Persistence is distribution-specific. Some systems use a firewall manager, while others restore a saved ruleset through a service. The available documentation establishes the forwarding and NAT syntax but does not define one save-and-restore command that is portable across all distributions.
Use the persistence method supported by your operating system, then reboot or restart only during a maintenance window. After the restore, inspect the active rules rather than trusting that a save operation succeeded. Make sure the forwarding sysctl is persistent independently of the NAT rules. If a firewall manager owns the ruleset, add the rule through that manager instead of mixing unmanaged commands with generated configuration.
Inspect rules and test a real connection
List the active NAT rules
sudo iptables -t nat -L POSTROUTING -n -v --line-numbersThe listing should show the source subnet, egress interface, target, and translated address (or MASQUERADE). The packet and byte counters are especially useful: they increase when matching traffic reaches the chain. Numbered output also helps identify an earlier broad rule that is taking precedence over the rule you intended to test.
Test from a private client
- From a client in the private subnet, initiate a new connection to a known external destination. Start a fresh connection after changing a NAT rule because an existing connection may retain its earlier conntrack mapping.
- On the gateway, verify that the
POSTROUTINGcounters increase. - Check that the client has the Linux server as its default gateway and that the server itself can reach the upstream network.
- Verify that the upstream network has a return route for the translated address.
- Inspect the filter-table
FORWARDpolicy if counters remain unchanged or replies are dropped. - Repeat with a second known destination if the first service might be unavailable; this separates a NAT problem from a remote application or DNS problem.
Testing both a new connection and a known working destination helps separate NAT configuration from DNS, application, or remote-service problems. Test from more than one private client when possible so an incorrect client route is not mistaken for a gateway-wide failure.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTroubleshoot the common failure modes
No private client can reach anything
- Run
sysctl net.ipv4.ip_forward. A value of0means routing is disabled. - Confirm the client default route points to the Linux gateway.
- Check that the SNAT rule is in the
nattable andPOSTROUTING, not in an unrelated table or chain. - Compare the rule’s source subnet with the client’s actual address and prefix.
- Confirm
-onames the interface that really carries the packet toward the upstream network. - Check that the server itself has upstream connectivity and that the upstream router can return traffic to the translated address.
NAT counters stay at zero
Zero counters usually mean the packet does not match the rule or never reaches the chain. Check the source address, subnet mask, egress interface, and routing decision. A client using IPv6 will not match an IPv4 iptables rule; configure IPv6 separately or ensure the test is IPv4. Also review rule order: an earlier NAT rule may handle the connection before this rule is reached.
Counters increase but the client still times out
This points away from rule matching and toward forwarding policy or return traffic. Inspect the filter-table FORWARD chain, confirm that established replies are accepted, and verify that the upstream router can return traffic through the translated address. Also check that the destination itself is reachable and not blocking the requested service. A counter increase proves that packets matched the NAT rule; it does not prove that replies came back or that the filter table accepted them.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
It worked until the next reboot
The rule was probably added only to the running firewall, or the forwarding sysctl was not saved persistently. Reapply the distribution-supported restore mechanism, then verify both iptables -t nat -L POSTROUTING -n -v and sysctl net.ipv4.ip_forward after reboot. Confirm that a firewall manager did not overwrite the manually added rule.
Connections break when the WAN address changes
Existing connection mappings contain the old address. Dynamic links should use MASQUERADE, and clients may need to establish new connections after the address changes. If the address is actually stable, use explicit SNAT instead of relying on interface discovery. Verify that the new interface address is also usable by the upstream network.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Only some private hosts fail
Compare the failing host’s address and default route with a working host. A source outside the configured subnet will not match a narrowly scoped rule, and a client with a different gateway may bypass the translating server entirely. If only one protocol or destination fails, review any protocol, destination, or port restriction added to the NAT or filter policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep rules narrow and maintainable
Start with the smallest rule that describes the intended flow: one private source subnet and one egress interface. Add a destination, protocol, or port match when the network policy calls for selective translation. Document why each exception exists, especially when several private networks share one gateway.
Review the rule order when multiple POSTROUTING rules exist. A prior rule may match first, and a broad earlier rule can prevent the intended SNAT rule from being reached. Use numbered listings, insert a rule at the required position, and remove obsolete rules rather than accumulating overlapping entries.
Remember that NAT is connection-oriented. Changing a rule does not rewrite every already-established flow; test with new connections and allow existing sessions to age out or close naturally. Monitor counters after deployment so an unexpected increase can reveal a client, route, or scope mistake. Keep a record of the private prefix, egress interface, translated address, and persistence mechanism so another administrator can safely reproduce or roll back the configuration.
Operational checklist
- Private subnet and client default gateway are correct.
- Egress interface and translated address are confirmed.
net.ipv4.ip_forwardis set to1now and after reboot.- SNAT is in
nat/POSTROUTINGwith source and egress matches. - MASQUERADE is used only when the egress address is dynamic.
- The filter-table
FORWARDpolicy permits the intended outbound and return flows. - The upstream network has a route back to the translated address.
- Rule counters increase during a fresh client connection.
- The configuration is saved through the distribution’s supported persistence system.
- Any optional port range or protocol restriction is required, supported, and documented.
- Rule order has been reviewed so an earlier catch-all does not override the intended translation.
Frequently Asked Questions
What is the correct iptables SNAT POSTROUTING rule?
For a fixed public address, use sudo iptables -t nat -A POSTROUTING -s 192.0.2.0/24 -o eth0 -j SNAT --to-source 198.51.100.10, replacing the example subnet, interface, and address. The source and egress matches keep unrelated traffic from being translated.
Do I need to enable IP forwarding for SNAT?
Yes. Set net.ipv4.ip_forward=1 with the system’s sysctl interface and make the setting persistent. NAT changes addresses, but forwarding is what allows the Linux host to route packets between interfaces.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Should I use SNAT or MASQUERADE?
Use SNAT when the public address is stable and explicitly assigned. Use MASQUERADE when the egress interface receives a changing address, such as through DHCP or a dial-up link. MASQUERADE selects the outgoing interface’s current address automatically.
Why do NAT counters increase while internet access still fails?
A counter increase shows that packets matched the NAT rule, not that forwarding was permitted or replies returned. Check the filter table’s FORWARD policy, established return traffic, the client’s default route, and the upstream route back to the translated address.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhy are SNAT counters at zero?
The packet may not match the source subnet or egress interface, may never reach the gateway, or may be IPv6 rather than IPv4. Check routing, interface names, client addressing, and whether an earlier rule handles the connection first.
Will an interactive iptables rule survive reboot?
Not necessarily. Running commands change the active firewall only. Use the persistence mechanism supported by the distribution or firewall manager, then inspect the restored NAT table and forwarding setting after reboot.
Why did connections stop working after the WAN address changed?
Existing connection-tracking mappings contain the old address. Use MASQUERADE for a dynamic egress address and create new client connections after the change. A fixed-address SNAT rule must be updated if its address genuinely changes.
Can I restrict the translated source ports?
For supported protocols, attach a source-port range to --to-source, such as 198.51.100.10:40000-50000. Do this only for a documented allocation requirement and after confirming compatibility with the protocol and iptables version.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The Bottom Line
Configure SNAT in nat/POSTROUTING, match the private source subnet and real egress interface, and use a stable address with SNAT --to-source. Use MASQUERADE when that interface address changes. Then enable and persist IPv4 forwarding, permit the flow in the filter table’s FORWARD chain, verify return routing, save the configuration through the distribution’s supported method, and test a fresh connection while watching counters.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
