RHEL Packet Filtering NAT & Kernel Parameters

To perform packet filtering network address translation (NAT) in RHEL, you use nftables or iptables to define rules that translate source or destination addresses, and you set kernel runtime parameters with the sysctl command or by writing to /proc/sys. This article explains both tasks with concrete commands, examples, and the configuration files that make the changes persistent.

Background: What Packet Filtering NAT Does

Network Address Translation (NAT) rewrites the source or destination IP address (and often port) as packets pass through a Linux router or firewall. In RHEL, the kernel’s netfilter framework handles this. Packet filtering NAT is the most common type: it lets many private-IP devices share one public IP (masquerading), forwards incoming traffic to an internal server (destination NAT), or redirects traffic to another host (redirect).

RHEL 8 and 9 ship with nftables as the default firewall backend, replacing iptables. However, the iptables command and its kernel modules are still available for compatibility. The underlying kernel tables are the same, but the syntax differs. This article shows both, since many existing systems still use iptables.

How to Perform Packet Filtering NAT in RHEL

You can use either nftables (recommended) or iptables. The steps below assume you have root access and a running RHEL system.

Using nftables (RHEL 8/9 default)

1. Install and start nftables: dnf install nftables then systemctl enable --now nftables.
2. Create a ruleset file, e.g., /etc/nftables.conf, or add rules directly with nft commands.
3. For source NAT (masquerade) on the WAN interface (e.g., eth0), add a rule in the nat table, postrouting chain:

   nft add table nat
   nft add chain nat postrouting { type nat hook postrouting priority 100; }
   nft add rule nat postrouting oifname "eth0" masquerade

4. For destination NAT (port forwarding) to an internal server (e.g., 192.168.1.10 port 80), add a rule in the prerouting chain:

   nft add chain nat prerouting { type nat hook prerouting priority -100; }
   nft add rule nat prerouting iifname "eth0" tcp dport 80 dnat to 192.168.1.10:80

5. To make rules persistent, save them with nft list ruleset > /etc/nftables.conf and ensure the service is enabled.

Using iptables (legacy)

1. Install iptables if not present: dnf install iptables-services.
2. Enable IP forwarding (see next section) – required for NAT to work.
3. Add a source NAT rule: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE.
4. Add a destination NAT rule: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80.
5. Save rules: service iptables save (for iptables-services) or use iptables-save > /etc/sysconfig/iptables.

Remember to allow forwarding in the firewall (e.g., firewall-cmd --add-masquerade for firewalld, or explicit FORWARD rules).

How to Set Kernel Runtime Parameters in RHEL

Kernel runtime parameters control the behavior of the running kernel, such as IP forwarding, TCP timestamps, or maximum file handles. You can view them in /proc/sys and change them temporarily with sysctl.

• View a parameter: sysctl net.ipv4.ip_forward or cat /proc/sys/net/ipv4/ip_forward.
• Set a parameter temporarily: sysctl -w net.ipv4.ip_forward=1 (takes effect immediately, lost on reboot).
• Make it persistent: add the line net.ipv4.ip_forward = 1 to /etc/sysctl.conf or a file in /etc/sysctl.d/, then run sysctl -p to apply.
• To apply all settings from config files: sysctl --system.

For NAT to work, you must enable IP forwarding. The parameter is net.ipv4.ip_forward. Set it to 1 on the router. Also, if you use firewalld, it may manage forwarding via its own settings; you can still use sysctl as the underlying kernel setting.

How to Choose Between nftables and iptables

For new deployments on RHEL 8/9, choose nftables because it is the default, has a cleaner syntax, and is actively maintained. Use iptables only if you have legacy scripts or a specific need for compatibility. The kernel module nf_tables is loaded by default; the legacy iptables uses the same netfilter hooks but a different userspace tool. Mixing both is possible but not recommended because they manage separate rule sets that can conflict.

Common Problems and How to Avoid Them

• NAT not working: Most often caused by IP forwarding being disabled. Check sysctl net.ipv4.ip_forward.
• Rules not persistent: For nftables, save the ruleset to /etc/nftables.conf. For iptables, use iptables-save and restore on boot, or enable the iptables service.
• Port forwarding fails: Ensure the FORWARD chain allows the traffic (e.g., iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT).
• Sysctl changes lost after reboot: You must add them to /etc/sysctl.conf or a file in /etc/sysctl.d/.
• Syntax errors in nftables: Always test with nft -c -f /etc/nftables.conf before applying.

Comparison: nftables vs iptables vs firewalld

firewalld is a higher-level frontend that uses nftables or iptables as backend. It provides a D-Bus interface and zones. For simple NAT, you can use firewall-cmd --add-masquerade and firewall-cmd --add-forward-port. However, for complex rules, direct nftables gives more control. nftables is more efficient, supports sets and maps, and has a more consistent syntax. iptables is older but widely documented. Choose based on your need: firewalld for simplicity, nftables for granular control, iptables for legacy compatibility.

Cost and Licensing Considerations

RHEL itself is a subscription-based operating system, but the kernel features for NAT and sysctl are part of the standard kernel and require no extra cost. The tools nftables, iptables, and sysctl are included in the base installation. There are no additional licensing fees for using these features.

Safety and Best Practices

When modifying kernel parameters, be cautious: some changes can affect network stability or security. For example, enabling IP forwarding turns the host into a router; ensure your firewall rules restrict what is forwarded. Always test rules in a non-production environment first. For sysctl, avoid setting parameters that you do not understand; consult the kernel documentation. Also, remember that runtime changes are not permanent unless saved.

Frequently Asked Questions

Do I need to enable IP forwarding for NAT?

Yes, for any NAT that involves routing between interfaces (e.g., masquerade or DNAT), the kernel must forward packets, so net.ipv4.ip_forward must be set to 1. Without it, packets are dropped.

How do I make nftables rules persistent in RHEL?

Save the current ruleset with nft list ruleset > /etc/nftables.conf and enable the nftables service with systemctl enable nftables. On boot, the service loads the file.

Can I use both iptables and nftables at the same time?

Technically yes, but they are separate rule sets and can interfere. It is better to choose one and stick with it. RHEL 8/9 uses nftables by default, but you can switch to iptables if needed.

What is the difference between SNAT and MASQUERADE?

SNAT (source NAT) changes the source IP to a fixed address; MASQUERADE is a special form of SNAT that automatically uses the IP of the outgoing interface, which is useful for dynamic WAN IPs. In iptables, MASQUERADE is used in POSTROUTING; in nftables, the masquerade keyword does the same.

How do I see current kernel parameters?

Use sysctl -a to list all parameters, or sysctl parameter.name to view a specific one. You can also read the files directly under /proc/sys.

Related

• Smart Plug Automation: How It Works
• Jellyfin vs Plex: Which Actually Wins?
• Every Assassin’s Creed Game Ranked Worst to Best