I remember I had to enable
ip_forward kernel parameter in the past in order to run SNAT/DNAT rules in
Today I was reading this post: http://blogs.aws.amazon.com/security/post/TxFRX7UFUIT2GD/How-to-Add-DNS-Filtering-to-Your-NAT-Instance-with-Squid
Per the author of above post, You do not have to enable IP Forwarding or add any FORWARD rule. You may search for the bold text in above article.
and then the author goes on to configure 2 iptables
prerouting (DNAT) rules.
Questions: So, Does this mean that
postrouting/prerouting (DNAT/SNAT) can work without
ip_forward ? OR am I missing something obvious here?