To let a private IPv4 subnet reach the internet through a Linux gateway, enable IPv4 forwarding and add a narrowly scoped rule in the nat table’s POSTROUTING chain. With a fixed public address, use SNAT:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
sudo iptables -t nat -A POSTROUTING
-s 192.0.2.0/24 -o eth0
-j SNAT --to-source 198.51.100.10Replace the example subnet, interface, and address with values actually assigned to your network. If the outgoing address changes, use MASQUERADE instead. Forwarding, the filter table’s FORWARD policy, return routing, and rule persistence are separate requirements.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What SNAT does in an iptables gateway
Source network address translation (SNAT) changes the source IPv4 address of packets leaving a gateway. A client on a private network might send a packet with source address 192.0.2.25. The gateway translates that source to its public address, such as 198.51.100.10, before sending the packet through the internet-facing interface. Replies are translated back and delivered to the original client.
For routed client traffic, SNAT belongs in the nat table and normally in POSTROUTING, which is evaluated after the kernel has selected the outgoing route. The iptables-extensions documentation also permits the SNAT target in INPUT and in user-defined chains called from the permitted contexts, but a gateway forwarding setup normally uses POSTROUTING. The Netfilter HOWTO shows the same table, chain, and target form used below.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
“This target is only valid in the nat table, in the POSTROUTING and INPUT chains, and user-defined chains which are only called from those chains.”
NAT is connection-oriented. Once the first packet of a connection matches the SNAT target, the kernel records the translation for that connection and applies it to subsequent packets. The target also ends further rule examination for that packet in the current chain. This is why a NAT rule should be precise: an overly broad rule can claim connections that should have remained untranslated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the topology before changing rules
Write down the three values that determine the rule:
- Private source network: the client subnet, for example
192.0.2.0/24. - Egress interface: the gateway interface connected toward the upstream network, for example
eth0. - Translated source address: a stable public IPv4 address assigned to that gateway, for example
198.51.100.10.
The addresses above are documentation examples from the reserved TEST-NET ranges. Do not copy them into a production rule. Confirm the real values with your interface configuration, routing table, and network administrator. The client must use the Linux server as its IPv4 router, and the server must have a route toward the destination through the egress interface.
Decide whether the upstream address is stable. A fixed address favors explicit SNAT. An address supplied dynamically by DHCP, a dial-up connection, or another changing interface configuration favors MASQUERADE.
Enable IPv4 forwarding
NAT does not turn a host into a router by itself. The kernel must be allowed to forward IPv4 packets between interfaces. Red Hat’s firewall guidance treats net.ipv4.ip_forward=1 as a prerequisite for IPv4 NAT.
Enable forwarding for the current boot
- Set the running kernel value through the sysctl interface:
sudo sysctl -w net.ipv4.ip_forward=1- Verify the result:
sysctl net.ipv4.ip_forwardThe output should show a value of 1. This change is immediate but may disappear at reboot.
Make forwarding persistent
Place the setting in the persistent sysctl configuration supported by your distribution. Many current Linux systems accept a file under /etc/sysctl.d/; others may manage the value through a distribution firewall or networking service. For a system using the standard sysctl loader, an example is:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
sudo sysctl --systemUse the configuration and reload procedure documented for your distribution, then recheck the value after a reboot or network-service restart.
Add a fixed-address SNAT rule
After forwarding is enabled and the addresses are confirmed, add the rule to the IPv4 NAT table:
sudo iptables -t nat -A POSTROUTING
-s 192.0.2.0/24 -o eth0
-j SNAT --to-source 198.51.100.10Each part has a distinct job:
-t natselects the NAT table rather than the default filter table.-A POSTROUTINGappends the rule to the chain evaluated after route selection.-s 192.0.2.0/24limits translation to the intended private source subnet.-o eth0limits translation to packets leaving through the internet-facing interface.-j SNATselects source NAT.--to-source 198.51.100.10specifies the address that replaces the private source.
Replace every example with an address or interface that exists on the server. Matching both the source subnet and egress interface prevents unrelated traffic, such as traffic between internal interfaces, from being translated accidentally.
Make the match narrower when the design requires it
You can add protocol, destination, or port constraints when only a subset of traffic should be translated. For example, a gateway serving several internal networks may give each network a separate rule, or a policy may translate only traffic destined for a particular upstream range. Keep the match as specific as the routing design requires; do not use a catch-all rule merely because it is shorter.
The SNAT target supports optional source-port ranges and randomization flags for supported protocols. Those options are useful only when you have a documented port-allocation requirement. Start with address and interface matching, then add protocol or port criteria deliberately and test the resulting connections.
Use MASQUERADE when the egress address changes
MASQUERADE is the dynamic-address form of source NAT. It obtains the address from the outgoing interface instead of requiring a fixed value in the rule. The Debian nftables manual describes it as “a special form of snat which always uses the outgoing interface’s IP address to translate to.”
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11sudo iptables -t nat -A POSTROUTING
-s 192.0.2.0/24 -o eth0
-j MASQUERADEUse this when eth0‘s address can change. When the interface has a stable public address, explicit SNAT states the intended translation clearly and avoids treating a fixed-address design as dynamic.
| Decision point | SNAT | MASQUERADE |
|---|---|---|
| Address source | Uses the address named by --to-source. |
Uses the current address of the outgoing interface. |
| Best fit | Stable, explicitly assigned public address. | Address assigned dynamically or expected to change. |
| Rule example | -j SNAT --to-source 198.51.100.10 |
-j MASQUERADE |
| Scope controls | Source subnet, egress interface, and optional protocol, destination, or port matches. | |
| Operational concern | Update the rule if the named public address changes. | Ensure the interface selected by -o is the one whose current address should be used. |
Permit forwarding in the filter policy
The NAT rule changes addresses; it does not automatically allow packets through the filter table. A server can show SNAT matches while still dropping the forwarded packet because the FORWARD chain policy or another filter rule denies it.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Review the active forwarding policy in the firewall system that owns the host. Add narrowly scoped rules permitting the intended traffic from the private interface or subnet to the egress interface, and permitting the corresponding return traffic according to that system’s established-connection model. There is no single portable filter command that is correct for every distribution, existing policy, or firewall manager. Avoid replacing a managed firewall configuration with ad hoc commands unless that is how the host is intentionally administered.
At minimum, distinguish these two questions during testing:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Did NAT match? Check the packet and byte counters on the NAT rule.
- Was forwarding allowed? Check the filter table’s
FORWARDchain and its counters or logs.
Understand the packet path and rule scope
A forwarded packet is first received on the private interface, evaluated for routing, and then sent toward the selected egress interface. The POSTROUTING hook is useful for SNAT because the outgoing route and interface are known at that point. The -o match therefore expresses an important design boundary: only traffic that is actually leaving through the named interface is translated.
Source matching is equally important. If the gateway serves more than one internal network, use a separate, explicit rule for each source range that is meant to share the public address. If one network should remain routed without translation, do not include its prefix in the SNAT match. Destination, protocol, and port conditions can further separate internet-bound traffic from internal or administrative flows.
Rule scope also makes later troubleshooting easier. A counter increase then tells you that traffic from the expected subnet selected the expected egress path. A broad rule can hide a routing mistake by translating packets that should have taken another path, so a shorter command is not necessarily a safer command.
Account for connection-oriented translation
SNAT is selected when a new connection first traverses the NAT chain. The translation is then associated with that connection, and later packets use the recorded mapping rather than repeatedly choosing a new rule. When testing a changed rule, create a new outbound connection so that an existing flow does not make an old mapping appear to persist.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →This behavior also explains why a rule can show only a small number of initial matches while a long-lived connection continues to pass traffic. Inspect counters while starting fresh connections, not only while sending data over a session that was opened before the rule change. The target stops further examination in the current chain for the packet that matches it, reinforcing the need to order and scope rules deliberately.
Use a controlled change sequence
- Record the current forwarding value and active NAT and filter rules before making changes.
- Confirm the client subnet, gateway interfaces, public address ownership, and route toward the upstream network.
- Enable forwarding and verify that the value is
1. - Add one narrowly scoped SNAT or MASQUERADE rule, rather than several overlapping catch-all rules.
- Confirm that the filter policy permits the intended outbound and return traffic.
- Generate a new connection from a private client and inspect counters immediately afterward.
- Persist the working configuration through the distribution’s supported manager, then repeat the test after a service restart or reboot.
Changing one element at a time—source prefix, egress interface, translated address, or filter permission—keeps the cause of a failure observable and avoids masking a routing or policy problem.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Persist the configuration safely
Rules entered with iptables are commonly active immediately but are not necessarily restored after a reboot. Persistence is distribution-specific: some systems use an iptables save/restore service, while others generate rules through a firewall manager or a compatibility layer. The available documentation establishes the forwarding and NAT syntax, not one universal save command.
- Use the persistence mechanism supported by your distribution and by the firewall service that owns the host.
- Record the private subnet, egress interface, translated address, and forwarding setting alongside the configuration.
- Reboot or restart the relevant service in a maintenance window and verify that the rule and forwarding value return.
- Do not assume that a rule displayed by an interactive shell is permanent until this test succeeds.
Verify an actual forwarded connection
Inspect the active NAT rule
List the POSTROUTING chain with numeric addresses, verbose counters, and rule numbers:
sudo iptables -t nat -L POSTROUTING -n -v --line-numbersConfirm that the source subnet, outgoing interface, target, and translated address match the intended design. The packet and byte counters should increase when a client generates new outbound connections.
Test from a private client
- Start a real outbound connection from a client in the matched subnet, not from the gateway itself.
- Check the NAT counters again. No increase usually means the traffic did not match the source or interface conditions, or it did not traverse this server.
- If counters increase but the client still times out, inspect the
FORWARDpolicy and the return route. - Confirm that the upstream network can route replies to the translated address through the Linux gateway.
- Test again after changing the smallest possible item, such as the source subnet or interface match, so the cause remains clear.
Use a destination and protocol that the client is expected to reach. A failed application can reflect a remote service problem; the NAT counters and forwarding state tell you whether the packet passed the gateway stages under your control.
Troubleshoot common failure modes
The client cannot reach anything and the NAT counter stays at zero
- Check
sysctl net.ipv4.ip_forward; a value of0means forwarding is disabled. - Compare the client’s actual source subnet with the rule’s
-svalue. - Confirm the packet leaves through the interface named by
-o. A different default route or failover link makes the rule miss. - Ensure the rule is in
-t nat -A POSTROUTING, not in the default filter table or an unrelated chain. - Verify that the client actually uses this server as its gateway.
The NAT counter rises, but connections still fail
- Inspect the filter table’s
FORWARDpolicy; NAT matching does not override a drop there. - Check the upstream return route. Replies must come back to the translating server’s public address.
- Confirm that the specified SNAT address is assigned to the gateway and is valid on the upstream network.
The configuration works until the public address changes
A fixed SNAT rule continues to name its old address. If the egress address is genuinely dynamic, replace the design with MASQUERADE or update the SNAT rule through the system that manages the interface. If the address is intended to be fixed, investigate why the assignment or route changed instead.
Internal traffic is being translated unexpectedly
Narrow the rule by source subnet and egress interface. A rule that matches every source on every interface can translate traffic that should remain inside the private network. Add destination or protocol restrictions where the network policy requires them.
Rules disappear after reboot
The interactive command was not persisted, or a distribution firewall manager rewrote the table during startup. Save the configuration through the host’s supported persistence method and verify it after a reboot rather than adding duplicate rules by hand.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational checklist
- IPv4 forwarding reports
1. - The private subnet and egress interface are correct.
- A stable public address is handled with SNAT; a changing interface address is handled with MASQUERADE.
- The rule is in the
nattable’sPOSTROUTINGchain. - The match is limited to the intended source and egress, with additional constraints where needed.
- The filter table’s
FORWARDpolicy permits the required traffic and return traffic. - The upstream network has a return route to the translated address.
- NAT counters increase during a test from a private client.
- The rule and forwarding setting survive the distribution’s restart or reboot procedure.
When to choose a different design
SNAT is appropriate when the gateway must present one or more public source addresses for routed private clients. It is not a substitute for correcting a missing route, enabling forwarding, or designing the filter policy. If the public address allocation changes frequently, MASQUERADE reduces address-maintenance work. If addresses are stable and policy depends on an explicit source, SNAT makes that choice visible in the rule.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Frequently Asked Questions
Where exactly should an iptables SNAT rule be placed?
For a routed IPv4 gateway, place it in the nat table’s POSTROUTING chain. The SNAT target is documented for POSTROUTING and INPUT, but POSTROUTING is the normal context for packets forwarded out an interface.
Should I use SNAT or MASQUERADE?
Use SNAT when the public source address is stable and explicitly assigned, for example with --to-source 198.51.100.10. Use MASQUERADE when the outgoing interface receives an address that can change; it uses that interface’s current address automatically.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Why can’t my private subnet reach the internet through the Linux gateway?
Check the requirements separately: net.ipv4.ip_forward must be 1, the client must use this server as its router, the source and egress matches must be correct, the filter table’s FORWARD policy must allow the flow, and the upstream network must return traffic to the translated address.
Does adding SNAT automatically permit forwarding?
No. SNAT changes packet addresses in the NAT table; it does not override a deny in the filter table. A matching NAT counter can increase even while the FORWARD chain drops the packet.
How can I tell whether the SNAT rule matched?
List the NAT POSTROUTING chain with verbose packet and byte counters, then start a new connection from a client in the private subnet. Counter increases show that traffic matched the rule; they do not by themselves prove that the filter policy or return route is correct.
Why do my counters stay at zero?
The traffic may not traverse this gateway, may come from a different source subnet, or may leave through an interface other than the one in -o. Also verify that the rule is in the nat table’s POSTROUTING chain and that IPv4 forwarding is enabled.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow do I keep the rule after a reboot?
Use the firewall or iptables persistence mechanism supported by your distribution. There is no single portable save command. After configuring persistence, restart the relevant service or reboot in a maintenance window and confirm that both the NAT rule and forwarding setting return.
Can I restrict SNAT to particular protocols or ports?
Yes. Match protocol, destination, or port criteria when the design calls for translating only a subset of traffic. The SNAT target also documents optional source-port ranges and randomization flags for supported protocols; add those options only for a documented requirement and test new connections afterward.
What happens if the public address changes after I configure SNAT?
A fixed SNAT rule continues to use the address named by --to-source. If the address is genuinely dynamic, use MASQUERADE or update the rule through the service that manages the interface. If it should be fixed, investigate the address or route change.
The Bottom Line
Configure IPv4 forwarding first, then use a narrowly matched nat/POSTROUTING rule: explicit SNAT for a stable public address and MASQUERADE for a changing one. Permit the flow in the filter table, verify return routing and counters from a real private client, and persist the configuration through your distribution’s supported firewall system.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
