> ## Content Index
> Fetch the complete content index at: https://www.novea.cc/llms.txt
> Use this file to discover other available public pages before exploring further.

# iptables from Scratch: Part 3 | NAT and Port Forwarding
- URL: https://www.novea.cc/iptables-from-scratch-part-3-nat-port-forwarding/
- Published: 2026-09-05T17:44:45.000Z
- Updated: 2026-09-05T17:44:45.000Z
- Description: Masquerade, DNAT and the one-liner that lets a whole LAN hide behind a single public IP.
- Author: Ethan Nicolas
- Tags: Linux, Networking

Filtering is the half of iptables everyone learns. NAT is the half that actually connects things: one public IP, a LAN of machines behind it, and the rules that make the internet come to them. This is Part 3, and it is all about rewriting addresses.

## Masquerade: the whole LAN wears one IP

Your router has one public address and a dozen devices behind it. When a laptop sends a packet out, the router rewrites the source to its own public IP and remembers the mapping. That is masquerade, and it is two lines:

```
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sysctl -w net.ipv4.ip_forward=1
```

First line: in the nat table, after routing, rewrite the source on the way out. Second line: actually forward packets between interfaces, which Debian disables by default. Make it permanent:

```
# /etc/sysctl.d/99-forward.conf
net.ipv4.ip_forward = 1
```

## DNAT: invite the internet in, selectively

Masquerade lets you reach out. To reach *in* — a web server on 192.168.1.10, say — you translate the destination:

```
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.10:443
```

Packets arriving on the public interface for port 443 get rewritten towards the internal server. Do not forget the matching FORWARD rule, because NAT happens before filtering and the forward chain still has the final say:

```
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 443 -d 192.168.1.10 -j ACCEPT
```

## Why you will mix up PREROUTING and POSTROUTING once

Everyone does. PREROUTING edits packets *before* the routing decision (incoming DNAT). POSTROUTING edits them *after* (outgoing masquerade). If your port forward does nothing, you put the rule in the wrong hook or forgot the FORWARD accept.

## See the translation working

```
iptables -t nat -L -n -v
conntrack -L | head            # the live NAT sessions, if conntrack is installed
```

The nat table listing shows your rules; conntrack shows the actual mappings in flight. When a connection "works from inside but not outside", these two commands pinpoint whether the rewrite or the forward is the problem.

NAT is where iptables stops being a filter and becomes the plumbing of your network. With filter rules from Part 2 and these NAT lines, one Linux box can be a perfectly respectable home or lab router.