I try to set up SNAT with firewalld on my CentOS-7-Router like described here, with additions from Karl Rupps explanation, but I end up like Eric. I also read some other documentation, but I am not able to get it to work, so that my client-IP is translated into another source IP.


firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -o enp1s0 -d -j SNAT --to-source


firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -s -j SNAT --to-source

gives a "success". I do a firewall-cmd --reload afterwards. But if I try to examine the table with iptables -t nat -nvL POSTROUTING the rule is not listed.

But if I apply one of the above rules again, firewalld warns me with e.g. Warning: ALREADY_ENABLED: rule '['-p', 'tcp', '-o', 'enp1s0', '-d', '', '-j', 'SNAT', '--to-source', '']' already is in 'ipv4:nat:POSTROUTING'- but no SNAT-functionality for the source-ip to be masqueraded as is working.

Maybe someone can explain me what I am doing wrong?

After hours of struggling, I still am hanging on DNAT/SNAT. I now use only iptables with:

1.) iptables -t nat -A PREROUTING -p tcp --dport 1433 -i enp1s0 -d -j DNAT --to-destination


2.) iptables -t nat -A POSTROUTING -p tcp --sport 1433 -o enp1s0 -s -j SNAT --to-source

so iptables -t nat -nvL PREROUTING shows:

pkts bytes target     prot opt in     out     source               destination         
129 12089 PREROUTING_direct  all  --  *      *             
129 12089 PREROUTING_ZONES_SOURCE  all  --  *      *             
129 12089 PREROUTING_ZONES  all  --  *      *             
0     0 DNAT       tcp  --  enp1s0 *         tcp dpt:1433 to:


iptables -t nat -nvL POSTROUTING shows:

 pkts bytes target     prot opt in     out     source               destination         
   97  7442 POSTROUTING_direct  all  --  *      *             
   97  7442 POSTROUTING_ZONES_SOURCE  all  --  *      *             
   97  7442 POSTROUTING_ZONES  all  --  *      *             
    0     0 SNAT       tcp  --  *      enp1s0            tcp spt:1433 to:

All done right, here are some more good explanations:
- https://wiki.ubuntuusers.de/iptables2
- https://netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html
- https://serverfault.com/questions/667731/centos-7-firewalld-remove-direct-rule

but still iptraf-ng lists: enter image description here

Isn't PREROUTING (resp. POSTROUTING) done before (resp. after) ip_forwarding from internal to external interface?

2 Answers 2

# Assuming that your Linux box has two NICs; eth0 attached to WAN and eth1 attached to LAN
# eth0 = outside
# eth1 = inside
# [LAN]----> eth1[GATEWAY]eth0 ---->WAN
# Run the following commands on LINUX box that will act as a firewall or NAT gateway
firewall-cmd --query-interface=eth0
firewall-cmd --query-interface=eth1
firewall-cmd --get-active-zone 
firewall-cmd --add-interface=eth0 --zone=external
firewall-cmd --add-interface=eth1 --zone=internal
firewall-cmd --zone=external --add-masquerade --permanent 
firewall-cmd --reload 
firewall-cmd --zone=external --query-masquerade 
# ip_forward is activated automatically if masquerading is enabled.
# To verify:
cat /proc/sys/net/ipv4/ip_forward 
# set masquerading to internal zone
firewall-cmd --zone=internal --add-masquerade --permanent
firewall-cmd --reload 
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o eth0 -j MASQUERADE
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --reload
  • Oh mean! This works! Great! Iptables is the only really covered topic in the internet! Thanks Commented May 15, 2020 at 16:36

There is a similar answer here:


That uses nmcli to set internal/external:

nmcli c mod ens224 connection.zone internal
nmcli c mod ens192 connection.zone external

but @Bruce Malaudzi 's answer is more informative. I'm not used to firewalld yet so I started out with the default/iptables advice: How can I use Linux as a Gateway? The firewalld default setup uses IP Chain differently, so its better to go all the way with firewalld.

Thanks for the iptraf-ng preview @jochen-gebsattel that's a great little program.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .