I remember I had to enable ip_forward kernel parameter in the past in order to run SNAT/DNAT rules in iptables successfully.

Today I was reading this post: http://blogs.aws.amazon.com/security/post/TxFRX7UFUIT2GD/How-to-Add-DNS-Filtering-to-Your-NAT-Instance-with-Squid

Per the author of above post, You do not have to enable IP Forwarding or add any FORWARD rule. You may search for the bold text in above article.

and then the author goes on to configure 2 iptables prerouting (DNAT) rules.

Questions: So, Does this mean that postrouting/prerouting (DNAT/SNAT) can work without ip_forward ? OR am I missing something obvious here?

  • In the mentioned aws link he is writing bout changing the port to another port on the same machine, this could be the reason it will work Commented Sep 20, 2023 at 19:07

1 Answer 1



By default, the IPv4 policy in Linux kernels disables support for IP forwarding. This prevents machines that run Linux from functioning as dedicated edge routers.

I made a test of redirection of the port 80 to a VM with PREROUTING without ip_forward enabled and it didn't work. When enabling ip_forward it success. So as I saw, the ip_forwarding option enables is necessary for the DNAT/SNAT service.

See more in here

  • I disagree, you do not need IP forwarding enabled in the kernel to do something that doesn't involve forwarding. I just tested this. Commented May 30, 2020 at 1:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .