Services

Resources

Company

Our Work

Blog

Back to Blog

NAT, DNAT & SNAT Explained: Advanced Iptables Usage for Cloud & Homelabs

NAT, DNAT & SNAT Explained: Advanced Iptables Usage for Cloud & Homelabs

One2N

Team

Back to Blog

NAT, DNAT & SNAT Explained: Advanced Iptables Usage for Cloud & Homelabs

One2N

Team

Back to Blog

NAT, DNAT & SNAT Explained: Advanced Iptables Usage for Cloud & Homelabs

One2N

Team

Most engineers today think of iptables as “old school,” but ask anyone deploying Docker, running a homelab, or debugging NAT in production
iptables still matters. Even with tools like nftables and firewalld available, iptables powers more networks than people realize.

When our team was restoring internet access on a remote Raspberry Pi NAS, iptables was the missing link. That’s why we’re revisiting the basics
because every modern SRE needs this utility in their toolkit.

What is Iptables?

Iptables is a user-space tool for configuring firewall rules in Linux. It leverages the Netfilter framework built into the kernel and lets you control packets down to the protocol, port, and source/destination IP.

Fast Facts

  • Still used in Docker, Kubernetes, and cloud VMs

  • Default on many distros

  • Handles NAT, DNAT, SNAT, and port forwarding

Setup & Key Syntax

Here's how iptables rules work a refresher for anyone who hasn't touched them in a while:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

  • Tables: filter, nat, mangle, raw

  • Chains: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING

  • Targets: ACCEPT, DROP, REJECT, SNAT/DNAT/MASQUERADE

  • Match: By protocol, source/destination, port, interface

Tip: Use iptables -L -n -v for a readable list of rules, and iptables-save to persist config.

Real-World Use Cases

1. Sharing Internet with NAT

We set up a Raspberry Pi to act as a NAT device for NAS and client machines.
Steps:

  • Enable IPv4 forwarding in /etc/sysctl.conf

  • MASQUERADE all outbound packets using POSTROUTING

2. Secure VLAN Routing for SRE

In a recent migration, our Nomad servers were in VLAN A and clients in VLAN B. Iptables DNAT allowed seamless routing across subnets no appliance required.

3. Custom Firewall for Docker/Kubernetes

Docker creates its own iptables chains knowing this helps debug weird traffic drops and port issues.

Common Commands Snippet

Block all SSH except from trusted subnet:

iptables -A INPUT -p tcp --dport 22 -s 192.168.12.0/24 -j ACCEPT

Drop outbound HTTPS to google.com:

iptables -A OUTPUT -d google.com -p tcp --dport 443 -j DROP

NAT for dynamic public IP:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Gotchas & Troubleshooting

  • Rules don’t persist by default use iptables-save and iptables-restore

  • Debugging rule chains is tricky; check rule order, use logging (-j LOG)

  • Consider nftables, but learn iptables for legacy compatibility

Takeaways for SREs and DevOps

  • Iptables is still essential for portable, reliable network security

  • Know your tools: understand chains, targets, and troubleshooting steps

  • Practice NAT, port forwarding, and VLAN routing these skills translate

Want guided tutorials or more deep-dives? Follow One2N’s blog for SRE lessons, hands-on tech, and modern engineering stories.

Most engineers today think of iptables as “old school,” but ask anyone deploying Docker, running a homelab, or debugging NAT in production
iptables still matters. Even with tools like nftables and firewalld available, iptables powers more networks than people realize.

When our team was restoring internet access on a remote Raspberry Pi NAS, iptables was the missing link. That’s why we’re revisiting the basics
because every modern SRE needs this utility in their toolkit.

What is Iptables?

Iptables is a user-space tool for configuring firewall rules in Linux. It leverages the Netfilter framework built into the kernel and lets you control packets down to the protocol, port, and source/destination IP.

Fast Facts

  • Still used in Docker, Kubernetes, and cloud VMs

  • Default on many distros

  • Handles NAT, DNAT, SNAT, and port forwarding

Setup & Key Syntax

Here's how iptables rules work a refresher for anyone who hasn't touched them in a while:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

  • Tables: filter, nat, mangle, raw

  • Chains: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING

  • Targets: ACCEPT, DROP, REJECT, SNAT/DNAT/MASQUERADE

  • Match: By protocol, source/destination, port, interface

Tip: Use iptables -L -n -v for a readable list of rules, and iptables-save to persist config.

Real-World Use Cases

1. Sharing Internet with NAT

We set up a Raspberry Pi to act as a NAT device for NAS and client machines.
Steps:

  • Enable IPv4 forwarding in /etc/sysctl.conf

  • MASQUERADE all outbound packets using POSTROUTING

2. Secure VLAN Routing for SRE

In a recent migration, our Nomad servers were in VLAN A and clients in VLAN B. Iptables DNAT allowed seamless routing across subnets no appliance required.

3. Custom Firewall for Docker/Kubernetes

Docker creates its own iptables chains knowing this helps debug weird traffic drops and port issues.

Common Commands Snippet

Block all SSH except from trusted subnet:

iptables -A INPUT -p tcp --dport 22 -s 192.168.12.0/24 -j ACCEPT

Drop outbound HTTPS to google.com:

iptables -A OUTPUT -d google.com -p tcp --dport 443 -j DROP

NAT for dynamic public IP:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Gotchas & Troubleshooting

  • Rules don’t persist by default use iptables-save and iptables-restore

  • Debugging rule chains is tricky; check rule order, use logging (-j LOG)

  • Consider nftables, but learn iptables for legacy compatibility

Takeaways for SREs and DevOps

  • Iptables is still essential for portable, reliable network security

  • Know your tools: understand chains, targets, and troubleshooting steps

  • Practice NAT, port forwarding, and VLAN routing these skills translate

Want guided tutorials or more deep-dives? Follow One2N’s blog for SRE lessons, hands-on tech, and modern engineering stories.

Most engineers today think of iptables as “old school,” but ask anyone deploying Docker, running a homelab, or debugging NAT in production
iptables still matters. Even with tools like nftables and firewalld available, iptables powers more networks than people realize.

When our team was restoring internet access on a remote Raspberry Pi NAS, iptables was the missing link. That’s why we’re revisiting the basics
because every modern SRE needs this utility in their toolkit.

What is Iptables?

Iptables is a user-space tool for configuring firewall rules in Linux. It leverages the Netfilter framework built into the kernel and lets you control packets down to the protocol, port, and source/destination IP.

Fast Facts

  • Still used in Docker, Kubernetes, and cloud VMs

  • Default on many distros

  • Handles NAT, DNAT, SNAT, and port forwarding

Setup & Key Syntax

Here's how iptables rules work a refresher for anyone who hasn't touched them in a while:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

  • Tables: filter, nat, mangle, raw

  • Chains: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING

  • Targets: ACCEPT, DROP, REJECT, SNAT/DNAT/MASQUERADE

  • Match: By protocol, source/destination, port, interface

Tip: Use iptables -L -n -v for a readable list of rules, and iptables-save to persist config.

Real-World Use Cases

1. Sharing Internet with NAT

We set up a Raspberry Pi to act as a NAT device for NAS and client machines.
Steps:

  • Enable IPv4 forwarding in /etc/sysctl.conf

  • MASQUERADE all outbound packets using POSTROUTING

2. Secure VLAN Routing for SRE

In a recent migration, our Nomad servers were in VLAN A and clients in VLAN B. Iptables DNAT allowed seamless routing across subnets no appliance required.

3. Custom Firewall for Docker/Kubernetes

Docker creates its own iptables chains knowing this helps debug weird traffic drops and port issues.

Common Commands Snippet

Block all SSH except from trusted subnet:

iptables -A INPUT -p tcp --dport 22 -s 192.168.12.0/24 -j ACCEPT

Drop outbound HTTPS to google.com:

iptables -A OUTPUT -d google.com -p tcp --dport 443 -j DROP

NAT for dynamic public IP:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Gotchas & Troubleshooting

  • Rules don’t persist by default use iptables-save and iptables-restore

  • Debugging rule chains is tricky; check rule order, use logging (-j LOG)

  • Consider nftables, but learn iptables for legacy compatibility

Takeaways for SREs and DevOps

  • Iptables is still essential for portable, reliable network security

  • Know your tools: understand chains, targets, and troubleshooting steps

  • Practice NAT, port forwarding, and VLAN routing these skills translate

Want guided tutorials or more deep-dives? Follow One2N’s blog for SRE lessons, hands-on tech, and modern engineering stories.

Most engineers today think of iptables as “old school,” but ask anyone deploying Docker, running a homelab, or debugging NAT in production
iptables still matters. Even with tools like nftables and firewalld available, iptables powers more networks than people realize.

When our team was restoring internet access on a remote Raspberry Pi NAS, iptables was the missing link. That’s why we’re revisiting the basics
because every modern SRE needs this utility in their toolkit.

What is Iptables?

Iptables is a user-space tool for configuring firewall rules in Linux. It leverages the Netfilter framework built into the kernel and lets you control packets down to the protocol, port, and source/destination IP.

Fast Facts

  • Still used in Docker, Kubernetes, and cloud VMs

  • Default on many distros

  • Handles NAT, DNAT, SNAT, and port forwarding

Setup & Key Syntax

Here's how iptables rules work a refresher for anyone who hasn't touched them in a while:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

  • Tables: filter, nat, mangle, raw

  • Chains: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING

  • Targets: ACCEPT, DROP, REJECT, SNAT/DNAT/MASQUERADE

  • Match: By protocol, source/destination, port, interface

Tip: Use iptables -L -n -v for a readable list of rules, and iptables-save to persist config.

Real-World Use Cases

1. Sharing Internet with NAT

We set up a Raspberry Pi to act as a NAT device for NAS and client machines.
Steps:

  • Enable IPv4 forwarding in /etc/sysctl.conf

  • MASQUERADE all outbound packets using POSTROUTING

2. Secure VLAN Routing for SRE

In a recent migration, our Nomad servers were in VLAN A and clients in VLAN B. Iptables DNAT allowed seamless routing across subnets no appliance required.

3. Custom Firewall for Docker/Kubernetes

Docker creates its own iptables chains knowing this helps debug weird traffic drops and port issues.

Common Commands Snippet

Block all SSH except from trusted subnet:

iptables -A INPUT -p tcp --dport 22 -s 192.168.12.0/24 -j ACCEPT

Drop outbound HTTPS to google.com:

iptables -A OUTPUT -d google.com -p tcp --dport 443 -j DROP

NAT for dynamic public IP:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Gotchas & Troubleshooting

  • Rules don’t persist by default use iptables-save and iptables-restore

  • Debugging rule chains is tricky; check rule order, use logging (-j LOG)

  • Consider nftables, but learn iptables for legacy compatibility

Takeaways for SREs and DevOps

  • Iptables is still essential for portable, reliable network security

  • Know your tools: understand chains, targets, and troubleshooting steps

  • Practice NAT, port forwarding, and VLAN routing these skills translate

Want guided tutorials or more deep-dives? Follow One2N’s blog for SRE lessons, hands-on tech, and modern engineering stories.

Most engineers today think of iptables as “old school,” but ask anyone deploying Docker, running a homelab, or debugging NAT in production
iptables still matters. Even with tools like nftables and firewalld available, iptables powers more networks than people realize.

When our team was restoring internet access on a remote Raspberry Pi NAS, iptables was the missing link. That’s why we’re revisiting the basics
because every modern SRE needs this utility in their toolkit.

What is Iptables?

Iptables is a user-space tool for configuring firewall rules in Linux. It leverages the Netfilter framework built into the kernel and lets you control packets down to the protocol, port, and source/destination IP.

Fast Facts

  • Still used in Docker, Kubernetes, and cloud VMs

  • Default on many distros

  • Handles NAT, DNAT, SNAT, and port forwarding

Setup & Key Syntax

Here's how iptables rules work a refresher for anyone who hasn't touched them in a while:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

  • Tables: filter, nat, mangle, raw

  • Chains: INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING

  • Targets: ACCEPT, DROP, REJECT, SNAT/DNAT/MASQUERADE

  • Match: By protocol, source/destination, port, interface

Tip: Use iptables -L -n -v for a readable list of rules, and iptables-save to persist config.

Real-World Use Cases

1. Sharing Internet with NAT

We set up a Raspberry Pi to act as a NAT device for NAS and client machines.
Steps:

  • Enable IPv4 forwarding in /etc/sysctl.conf

  • MASQUERADE all outbound packets using POSTROUTING

2. Secure VLAN Routing for SRE

In a recent migration, our Nomad servers were in VLAN A and clients in VLAN B. Iptables DNAT allowed seamless routing across subnets no appliance required.

3. Custom Firewall for Docker/Kubernetes

Docker creates its own iptables chains knowing this helps debug weird traffic drops and port issues.

Common Commands Snippet

Block all SSH except from trusted subnet:

iptables -A INPUT -p tcp --dport 22 -s 192.168.12.0/24 -j ACCEPT

Drop outbound HTTPS to google.com:

iptables -A OUTPUT -d google.com -p tcp --dport 443 -j DROP

NAT for dynamic public IP:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Gotchas & Troubleshooting

  • Rules don’t persist by default use iptables-save and iptables-restore

  • Debugging rule chains is tricky; check rule order, use logging (-j LOG)

  • Consider nftables, but learn iptables for legacy compatibility

Takeaways for SREs and DevOps

  • Iptables is still essential for portable, reliable network security

  • Know your tools: understand chains, targets, and troubleshooting steps

  • Practice NAT, port forwarding, and VLAN routing these skills translate

Want guided tutorials or more deep-dives? Follow One2N’s blog for SRE lessons, hands-on tech, and modern engineering stories.

Share
Share
On this page
Section
On this page
Tags
In this post

section

Tags
Share
Related Content

No items

How to read SRE graphs without lying to yourself

iptables, Linux firewall, iptables tutorial, SRE, DevOps, network security, firewall rules, NAT, DNAT, SNAT, VLAN, netfilter, packet filtering, Linux network, cloud firewall, homelab, nftables alternative, iptables configuration, iptables examples, docker firewall, kubernetes firewall

Continue reading.

How to evaluate AI SRE agents for production?

Hemant Kumar

Staff SRE @One2N

AI SRE agents promise faster incident response. The hard part is knowing which ones you can trust when production is noisy. This post shares how we evaluated OpenSRE before we let any of them influence a production incident.

Understanding K8sGPT Auto Remediation

Sanket Rajgiri

SRE @One2N

Conway's Law as a lever to fix legacy architectures

Chinmay Naik

CEO @One2N

Conway’s law talks about how software architecture mirrors the org chart. Learn what this means in practice and how to use Reverse Conway Maneuver to refactor existing system architectures.

Hardening Kubernetes Security with Istio Ambient Mode on Flat Networks

Harshwardhan Mehrotra

SRE @One2N

Spandan Ghosh

Content @One2N

Learn how One2N used Istio Ambient mode to enforce zero-trust security on a flat EKS Hybrid network - with mTLS, SPIFFE identity, egress control, and NetworkPolicies.

Git was not built for multiple AI agents. Worktrees fix that.

Srivatsa RV

SRE @One2N

Spandan Ghosh

Content @One2N

Running multiple AI coding agents on the same repo? Git's single-checkout model breaks fast. Learn how git worktrees give each agent its own isolated workspace.

Building Observable Go APIs With OpenTelemetry & Prometheus

Spandan Ghosh

Content @One2N

A hands-on guide to Go API observability using OTEL and Prometheus, structured logs, metrics, distributed traces, and correlation IDs baked in from day zero.

How to evaluate AI SRE agents for production?

Hemant Kumar

Staff SRE @One2N

AI SRE agents promise faster incident response. The hard part is knowing which ones you can trust when production is noisy. This post shares how we evaluated OpenSRE before we let any of them influence a production incident.

Understanding K8sGPT Auto Remediation

Sanket Rajgiri

SRE @One2N

Conway's Law as a lever to fix legacy architectures

Chinmay Naik

CEO @One2N

Conway’s law talks about how software architecture mirrors the org chart. Learn what this means in practice and how to use Reverse Conway Maneuver to refactor existing system architectures.

Hardening Kubernetes Security with Istio Ambient Mode on Flat Networks

Harshwardhan Mehrotra

SRE @One2N

Spandan Ghosh

Content @One2N

Learn how One2N used Istio Ambient mode to enforce zero-trust security on a flat EKS Hybrid network - with mTLS, SPIFFE identity, egress control, and NetworkPolicies.

Blogs

Subscribe for more such content

Get the latest in software engineering best practices straight to your inbox. Subscribe now!

Subscribe for more such content

Get the latest in software engineering best practices straight to your inbox. Subscribe now!

Subscribe for more such content

Get the latest in software engineering best practices straight to your inbox. Subscribe now!