The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Use your Linux VPS as a NAT gateway by enabling IPv4 forwarding, translating traffic from the private subnet in a postrouting NAT chain, permitting the forwarded connections in the firewall, and routing client replies back through the VPS. The VPS needs one Internet-facing interface and a private interface, tunnel, bridge, or reachable private subnet. Clients must use the VPS as their default gateway (or have a route pointing to it).
What a Linux VPS NAT gateway does
A NAT gateway sits between a private network and the Internet. It performs two separate jobs:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Routing: forwards packets between the private side and the VPS’s WAN interface.
- Source NAT: changes the source address on outbound packets so Internet hosts send replies to the VPS. The VPS then tracks each connection and delivers the replies to the originating private client.
Ubuntu describes the result this way: “Traffic leaving your private network is thus ‘masqueraded’ as having originated from your Ubuntu gateway machine.” The private clients still need a route to the VPS, and the VPS must have a working default route to the Internet. NAT does not fix a missing or asymmetric route.
This guide covers IPv4 forwarding and nftables. The same design can be implemented with iptables/UFW on distributions that use those tools, but do not create competing NAT definitions in both frameworks without first inspecting the active ruleset.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Plan the topology before changing the VPS
Identify the two sides
Write down the actual interface and address on each side before applying commands. Names such as eth0, ens3, ens4, wg0, or a bridge are only examples; cloud images commonly use different names.
| Function | Example | What to verify |
|---|---|---|
| Internet-facing interface | ens3 |
It has the VPS’s public or provider-routed address and a default route. |
| Private side | ens4, wg0, bridge, or a private VLAN |
It can reach the client subnet and is not accidentally treated as the WAN interface. |
| Private source range | 10.20.0.0/24 |
It exactly covers the clients that should be translated, without unrelated networks. |
Check the current state with your distribution’s normal network tools, for example:
ip -br address
ip route
Record the WAN interface, the private interface or tunnel, the private CIDR, and the public address if it is static. A narrow source range is safer than translating every packet that happens to leave the VPS.
Decide whether the public address is dynamic or fixed
Use masquerade when the address on the external interface can change. Masquerade derives the source address from the output interface. Use explicit SNAT when the public source address is fixed and you want the rule to name it directly.
| Condition | Preferred rule | Reason |
|---|---|---|
| Dynamic, provider-assigned WAN address | masquerade |
The current address is selected from the output interface. |
| Fixed public address | snat to <PUBLIC_IP> |
The translated address is explicit and stable. |
If you translate to an address that is not owned by the NAT VPS, the upstream network must route that address back to the VPS. Without that return route, replies cannot be delivered even if the NAT rule matches.
Prerequisites and safety checks
- Root or equivalent administrative access to the VPS.
- A configured private interface, tunnel, bridge, or provider private network.
- A working default route from the VPS to the Internet.
- Knowledge of the client subnet and the real WAN interface name.
- A maintenance path that will remain available while firewall rules are changed.
Inspect existing firewall rules before adding anything. A distribution may already load nftables, iptables, UFW, or a provider-specific firewall. Keep one authoritative NAT configuration. Duplicating rules can make counters and troubleshooting misleading and can produce behavior that changes when services restart.
Enable IPv4 forwarding persistently
Linux will not route packets between interfaces until IPv4 forwarding is enabled. Red Hat’s documented router procedure writes the setting to a file under /etc/sysctl.d and then loads that file:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf
Verify both the live value and the file:
sysctl net.ipv4.ip_forward
cat /etc/sysctl.d/95-IPv4-forwarding.conf
The command should report net.ipv4.ip_forward = 1. A setting that works only until reboot is not a complete gateway configuration; ensure your distribution loads the file during boot and check the value again after a planned restart.
Configure source NAT with nftables
Create a postrouting NAT chain
Masquerading belongs in a NAT table’s postrouting chain. The following skeleton uses an IPv4 table, the private range 10.20.0.0/24, and WAN interface ens3. Replace all three examples before running it.
nft add table ip nat
nft 'add chain ip nat postrouting { type nat hook postrouting priority 100; policy accept; }'
nft add rule ip nat postrouting ip saddr 10.20.0.0/24 oifname "ens3" masquerade
The source-range and output-interface conditions are important. They prevent unrelated local traffic from being translated and ensure that only packets leaving through the Internet-facing interface are changed. Masquerade is a special case of source NAT, uses connection tracking, and is meaningful in a postrouting NAT chain. It is available in nftables on Linux kernels from 3.18 onward.
Recommended Free Tools
Use SNAT for a fixed public address
If the VPS has a fixed public address, use an explicit source address instead of masquerade:
nft add rule ip nat postrouting ip saddr 10.20.0.0/24 oifname "ens3" snat to 203.0.113.10
Replace 203.0.113.10 with the address assigned to the VPS. Do not use this form for an address that is not routed to the VPS by the upstream network. The outside network must know that the translated address is reachable through this gateway.
Inspect the resulting rules
nft list ruleset
Confirm that the table is an IPv4 NAT table, the chain has a postrouting NAT hook, and the rule contains the intended private CIDR and WAN interface. If a table or chain already exists, inspect it rather than blindly issuing duplicate creation commands.
Allow forwarding through the firewall
A correct POSTROUTING rule does not override a filter policy that drops packets earlier. Permit new connections from the private network to the WAN and permit return packets that belong to those connections. The exact nftables filter-chain layout varies by distribution, so add equivalent rules to the active forward chain rather than creating an unrelated second firewall policy.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
The logical rules are:
- From the private interface or private CIDR, out the WAN interface: allow new and established traffic that your policy intends to route.
- From the WAN interface back to the private side: allow only
ESTABLISHED,RELATEDtraffic for connections initiated by private clients.
For a restrictive iptables-based firewall, the equivalent pattern is commonly expressed as:
iptables -A FORWARD -s 10.20.0.0/24 -o ens3 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ens3 -d 10.20.0.0/24 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
Adapt the source range, interface, and policy to your system. Ubuntu documents this style together with UFW/iptables integration. If your distribution uses nftables directly, do not assume these iptables commands alter the nftables rules you are inspecting; determine which compatibility layer and firewall manager is active first.
Route clients through the VPS
Set the default gateway or a specific route
Every private client must send Internet-bound packets to the NAT VPS. You can set the VPS’s private address as the client’s default gateway, or add a narrower route for only the destinations that should use the gateway. A client with no route to the VPS may send traffic elsewhere, while a client with a route only in one direction can create asymmetric flows.
For a routed private subnet, the upstream device that serves the clients must also know that the VPS is the next hop for that subnet. For a WireGuard or similar tunnel, put the intended private prefixes in the peer’s allowed routes and make the VPS the gateway for those clients. The exact client configuration depends on the network manager or tunnel software; the invariant is that packets for the Internet enter the VPS’s private side.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check the VPS’s own routing
ip route
ip route get 1.1.1.1
The route lookup should select the WAN interface and the provider’s next hop for an Internet destination. If the VPS itself cannot reach the Internet, forwarding and NAT cannot succeed for clients.
Make the configuration survive a reboot
The sysctl file above provides persistent forwarding. Firewall persistence is distribution-specific. Save the nftables rules with the supported service or configuration mechanism for your distribution, then verify that the service loads the same rules at boot. If you use UFW or another firewall manager, persist rules through that manager rather than editing generated files that it will overwrite.
Before declaring the gateway complete:
- Save the active firewall configuration using the distribution’s documented method.
- Confirm the forwarding sysctl is loaded from
/etc/sysctl.d. - Schedule a controlled reboot or service restart with console access available.
- Afterward, run
sysctl net.ipv4.ip_forward,ip route, andnft list ruleset(oriptables-savefor an iptables setup). - Test from a private client, not only from the VPS itself.
Test the gateway in the right order
Testing each layer separately shows where a failure occurs.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- Private link: from a client, ping or otherwise reach the VPS’s private address. If this fails, fix the interface, tunnel, bridge, or client route first.
- VPS Internet access: from the VPS, verify that its default route and name resolution work. Test an IP address separately from a hostname so DNS does not obscure a routing problem.
- Forwarding: generate traffic from a client and inspect the firewall’s forward-chain counters. A counter that never increases usually means the client route, interface, CIDR, or filter rule is wrong.
- NAT match: inspect the postrouting rule counters while the client opens a new connection. The rule must match the actual source CIDR and the interface selected by the route.
- Return path: confirm that replies arrive on the WAN side and are delivered to the client on the private side. Connection tracking must see both directions of the flow.
- Reboot behavior: repeat the checks after a controlled restart to prove that forwarding and firewall persistence work.
Use packet captures on both interfaces and conntrack inspection when counters alone do not explain the failure. Capture enough of the flow to determine whether the packet leaves the private interface, exits the WAN interface with a translated source, and returns to the VPS.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why forwarding works one way but replies fail
The client is not using the VPS as its gateway
The outbound packet may reach the VPS through an ad hoc route while the reply follows a different gateway. Set a consistent default route or destination-specific route on the client and verify the path with the client’s route lookup.
The private CIDR does not match the NAT rule
A rule for 10.20.0.0/24 will not match a client in 10.20.1.0/24. Compare the source address seen on the private interface with the rule’s ip saddr condition. Correct the CIDR rather than broadening it to an unnecessarily large range.
The wrong WAN interface is named
If routing selects ens5 but the rule matches ens3, masquerading never occurs. Use ip route get <internet-address> and copy the selected output interface into the rule.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Forwarding is disabled or filtered
Check sysctl net.ipv4.ip_forward after boot. Then inspect the active FORWARD policy and counters. NAT occurs after the forwarding decision; a dropped packet cannot be repaired by adding another POSTROUTING rule.
The translated address has no upstream return route
This is common when explicit SNAT uses an address other than the VPS’s own address. Ask the upstream network to route that address to the VPS, or use the VPS’s assigned address with masquerade when appropriate.
Legacy and nftables rules are mixed
iptables commands may use a compatibility backend while nftables commands address a different ruleset or hook arrangement. Inspect nft list ruleset and iptables-save, identify the active manager, and consolidate the NAT definition. Do not add duplicate masquerade rules merely because one command’s output appears empty.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Connection state is stale
NAT is stateful. After changing addresses, interfaces, or rules, old connection-tracking entries can preserve the previous path. Test with a new connection and, during a maintenance window, inspect or clear stale conntrack state using the facilities supported by your distribution.
Optional: publish an internal service with DNAT
Outbound NAT is not required to expose an internal service. For inbound publishing, create a DNAT rule in a prerouting NAT chain that maps selected ports on the external interface to the internal host. For example, TCP ports 80 and 443 could be directed to an internal web server. Red Hat documents this external-interface-to-internal-host pattern.
Port forwarding still requires all of the following:
- A filter rule that intentionally permits the selected inbound ports.
- An internal host that listens on the destination address and port.
- A return path from the internal host through the NAT VPS.
- SNAT or masquerade when needed so replies return through the VPS rather than taking an asymmetric route.
Do not expose ports that the service owner and firewall policy have not explicitly approved. Publishing a port changes the threat surface; restrict the destination and protocol as narrowly as possible.
Masquerade versus SNAT: the practical decision
| Question | Masquerade | SNAT |
|---|---|---|
| Where is it placed? | IPv4 NAT postrouting chain |
IPv4 NAT postrouting chain |
| How is the source chosen? | Derived from the output interface’s current address | Set explicitly with snat to <PUBLIC_IP> |
| Best fit | Dynamic external address | Fixed public address |
| Main routing requirement | The VPS’s interface address must be reachable upstream | The specified public address must be routed back to the VPS |
Neither form replaces forwarding or firewall acceptance. Both rely on connection tracking to associate replies with the translated outbound connection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOperational checklist
- Identify the actual WAN interface and private interface or tunnel.
- Choose a private CIDR that includes only intended clients.
- Enable and persist
net.ipv4.ip_forward=1. - Use one firewall/NAT framework and inspect its active rules.
- Place masquerade or SNAT in an IPv4
postroutingNAT chain. - Allow private-to-WAN forwarding and stateful return traffic.
- Set each client or upstream router to use the VPS as its gateway.
- Ensure any explicit SNAT address is routed back to the VPS.
- Persist firewall rules and test after reboot.
- Use rule counters, conntrack, and packet captures to diagnose asymmetric paths.
Limits and scope
The commands in this guide are IPv4 examples. IPv6 forwarding and translation use different address and policy decisions and should not be assumed to work because IPv4 NAT does. Provider-level security groups, private-network ACLs, and host firewalls can also block forwarding outside the VPS’s local ruleset; check those controls when the local counters show traffic but the provider does not pass it.
No universal throughput or reliability figure applies to a NAT gateway built on an arbitrary VPS. Performance depends on the provider, virtual CPU, packet size, connection count, firewall rules, and tunnel overhead. Size and monitor the gateway for the traffic pattern you actually expect rather than relying on a generic benchmark.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
