I try to set up SNAT with firewalld on my CentOS-7-Router like described here, with additions from Karl Rupps explanation, but I end up like Eric. I also read some other documentation, but I am not able to get it to work, so that my client-IP is translated into another source IP.


firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -o enp1s0 -d -j SNAT --to-source


firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -s -j SNAT --to-source

gives a "success". I do a firewall-cmd --reload afterwards. But if I try to examine the table with iptables -t nat -nvL POSTROUTING the rule is not listed.

But if I apply one of the above rules again, firewalld warns me with e.g. Warning: ALREADY_ENABLED: rule '['-p', 'tcp', '-o', 'enp1s0', '-d', '', '-j', 'SNAT', '--to-source', '']' already is in 'ipv4:nat:POSTROUTING'- but no SNAT-functionality for the source-ip to be masqueraded as is working.

Maybe someone can explain me what I am doing wrong?

After hours of struggling, I still am hanging on DNAT/SNAT. I now use only iptables with:

1.) iptables -t nat -A PREROUTING -p tcp --dport 1433 -i enp1s0 -d -j DNAT --to-destination


2.) iptables -t nat -A POSTROUTING -p tcp --sport 1433 -o enp1s0 -s -j SNAT --to-source

so iptables -t nat -nvL PREROUTING shows:

pkts bytes target     prot opt in     out     source               destination         
129 12089 PREROUTING_direct  all  --  *      *             
129 12089 PREROUTING_ZONES_SOURCE  all  --  *      *             
129 12089 PREROUTING_ZONES  all  --  *      *             
0     0 DNAT       tcp  --  enp1s0 *         tcp dpt:1433 to:


iptables -t nat -nvL POSTROUTING shows:

 pkts bytes target     prot opt in     out     source               destination         
   97  7442 POSTROUTING_direct  all  --  *      *             
   97  7442 POSTROUTING_ZONES_SOURCE  all  --  *      *             
   97  7442 POSTROUTING_ZONES  all  --  *      *             
    0     0 SNAT       tcp  --  *      enp1s0            tcp spt:1433 to:

All done right, here are some more good explanations:
- https://wiki.ubuntuusers.de/iptables2
- https://netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html
- https://serverfault.com/questions/667731/centos-7-firewalld-remove-direct-rule

but still iptraf-ng lists: enter image description here

Isn't PREROUTING (resp. POSTROUTING) done before (resp. after) ip_forwarding from internal to external interface?

2 Answers 2

# Assuming that your Linux box has two NICs; eth0 attached to WAN and eth1 attached to LAN
# eth0 = outside
# eth1 = inside
# [LAN]----> eth1[GATEWAY]eth0 ---->WAN
# Run the following commands on LINUX box that will act as a firewall or NAT gateway
firewall-cmd --query-interface=eth0
firewall-cmd --query-interface=eth1
firewall-cmd --get-active-zone 
firewall-cmd --add-interface=eth0 --zone=external
firewall-cmd --add-interface=eth1 --zone=internal
firewall-cmd --zone=external --add-masquerade --permanent 
firewall-cmd --reload 
firewall-cmd --zone=external --query-masquerade 
# ip_forward is activated automatically if masquerading is enabled.
# To verify:
cat /proc/sys/net/ipv4/ip_forward 
# set masquerading to internal zone
firewall-cmd --zone=internal --add-masquerade --permanent
firewall-cmd --reload 
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o eth0 -j MASQUERADE
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --reload
  • Oh mean! This works! Great! Iptables is the only really covered topic in the internet! Thanks May 15, 2020 at 16:36

There is a similar answer here:


That uses nmcli to set internal/external:

nmcli c mod ens224 connection.zone internal
nmcli c mod ens192 connection.zone external

but @Bruce Malaudzi 's answer is more informative. I'm not used to firewalld yet so I started out with the default/iptables advice: How can I use Linux as a Gateway? The firewalld default setup uses IP Chain differently, so its better to go all the way with firewalld.

Thanks for the iptraf-ng preview @jochen-gebsattel that's a great little program.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.