A Linux VPS can provide Internet access to a private subnet, tunnel, or virtual machine network if four things are correct: IPv4 forwarding is enabled, clients route through the VPS, a postrouting NAT rule translates their source addresses, and the firewall permits both outbound and return traffic. The procedure below uses nftables for a modern Linux setup and shows the equivalent iptables pattern where distribution tooling still requires it.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a VPS NAT gateway does
A NAT gateway has an inside and an outside. The inside is a private interface, bridge, VLAN, WireGuard interface, or other tunnel carrying traffic from clients. The outside is the VPS interface with Internet connectivity. The VPS routes packets between those sides and changes the source address on packets leaving the outside interface. Internet replies then return to the VPS, where connection tracking reverses the translation and forwards the replies to the originating client.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Ubuntu’s documentation describes the result this way: “Traffic leaving your private network is thus ‘masqueraded’ as having originated from your Ubuntu gateway machine.” Masquerading is source NAT (SNAT) that selects the address currently assigned to the outgoing interface.
| Component | Required role | Example to verify |
|---|---|---|
| Private clients | Use the VPS as their default gateway, or have a route for the destinations that should use it. | ip route on a client |
| VPS private side | Receives packets from the private CIDR. | wg0, eth1, a bridge, or another actual interface name |
| VPS external side | Has the working default route to the Internet. | ip route and ip route get 1.1.1.1 |
| Forwarding | Allows the Linux kernel to route packets between interfaces. | sysctl net.ipv4.ip_forward returns 1 |
| NAT | Rewrites private source addresses on outbound packets. | Matching postrouting rule and increasing counters |
| Filter policy | Accepts the intended outbound flow and established return packets. | Forward-chain rules and counters |
Forwarding, NAT, firewall acceptance, and return routing are separate requirements. A correct masquerade rule cannot fix a client that has no route to the VPS, and an enabled forwarding sysctl cannot overcome a filter chain that drops the packet.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Plan the topology before changing the VPS
- Use a Linux VPS with administrative access and a functioning Internet-facing interface.
- Know the real external interface name; common examples include
ens3andeth0, but names vary. - Know the private interface, tunnel, or bridge and the private IPv4 CIDR it carries, such as
10.20.0.0/24. - Decide whether the external address is dynamic or fixed. Masquerade is intended for an address that can change; explicit SNAT is clearer for a fixed public address.
- Choose one firewall/NAT framework. Do not add nftables and legacy iptables NAT rules blindly on the same host.
- Keep a console or out-of-band recovery path available before changing a restrictive forwarding policy. A mistake in a filter rule should not remove your only management access.
The private range in a NAT rule should be as narrow as the actual clients. Translating an unnecessarily broad range can hide unrelated traffic and make later troubleshooting difficult.
1. Identify interfaces, addresses, and routes
Run these commands on the VPS as root or through sudo:
ip -br addr
ip route
ip route get 1.1.1.1
ip linkFrom the output, record three values:
<WAN_IF>: the interface selected for Internet traffic by the VPS default route.<PRIVATE_IF>: the interface or tunnel on which private clients arrive.<PRIVATE_CIDR>: the source subnet to translate, for example10.20.0.0/24.
If the VPS has several uplinks, use the interface shown by ip route get for the destinations your clients will reach. A NAT rule attached to the wrong output interface will never match. Also record the VPS’s private-side address; clients will use that address as their gateway.
2. Enable IPv4 forwarding persistently
Linux must be allowed to route IPv4 packets. Red Hat’s documented router procedure writes the setting to a sysctl drop-in and loads it immediately:
echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
sysctl -p /etc/sysctl.d/95-IPv4-forwarding.confConfirm the running kernel value:
sysctl net.ipv4.ip_forwardThe output must contain net.ipv4.ip_forward = 1. The file in /etc/sysctl.d makes the setting survive a reboot on systems that load that directory. Check it again after reboot testing; a temporary command such as sysctl -w net.ipv4.ip_forward=1 alone is not a persistent configuration.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Inspect the active firewall framework
Before creating rules, inspect what is already active:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
nft list ruleset
iptables-saveModern distributions commonly expose nftables directly. Ubuntu also documents iptables rules through its firewall tooling. Use the framework that already owns the host’s policy, document the change in that framework, and remove or deliberately reconcile obsolete rules rather than creating two independent NAT configurations. Duplicate definitions can make counters and packet paths confusing, and legacy-versus-nftables behavior depends on the kernel and distribution.
4. Add outbound NAT with nftables
Masquerade for a dynamic external address
The nftables NAT rule belongs in a postrouting NAT chain. Adapt the interface and CIDR before applying these commands:
nft add table ip nat
nft 'add chain ip nat postrouting { type nat hook postrouting priority 100; policy accept; }'
nft add rule ip nat postrouting ip saddr <PRIVATE_CIDR> oifname "<WAN_IF>" masqueradeFor example, a private range of 10.20.0.0/24 leaving through ens3 would match that source range and only that output interface. The nftables documentation identifies masquerade as a special case of SNAT, available from Linux kernel 3.18, and notes that it makes sense in a postrouting NAT chain. Stateful NAT relies on connection tracking, so the first packet of a flow creates state that later packets use for reverse translation.
The commands that add a table or chain fail if an object with the same name already exists. That is useful protection against accidental duplication: inspect nft list ruleset and add only the missing object or rule. After adding the rule, inspect it directly:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
nft list table ip natSNAT for a fixed public address
If the VPS should always translate to a particular public address, use explicit SNAT instead:
nft add rule ip nat postrouting ip saddr <PRIVATE_CIDR> oifname "<WAN_IF>" snat to <PUBLIC_IP>Replace <PUBLIC_IP> with the fixed address assigned for this purpose. If that address is not the NAT box’s own address, the upstream network must route it back to the VPS; otherwise replies have nowhere to return. This return-route requirement is fundamental to source NAT and is not repaired by changing the local rule.
5. Permit forwarding and stateful replies
NAT is evaluated after the packet has traversed the forwarding decision. If the forward policy is restrictive, allow new connections from the private side to the Internet-facing side and allow only established or related replies in the opposite direction. One nftables pattern is:
nft add table inet filter
nft 'add chain inet filter forward { type filter hook forward priority 0; policy drop; }'
nft add rule inet filter forward iifname "<PRIVATE_IF>" oifname "<WAN_IF>" ip saddr <PRIVATE_CIDR> ct state new,established,related accept
nft add rule inet filter forward iifname "<WAN_IF>" oifname "<PRIVATE_IF>" ct state established,related acceptThe first rule permits clients in the chosen source range to start connections and to continue them. The second permits return traffic that connection tracking associates with those connections; it does not open every inbound port on the private network. If a filter table and forward chain already exist, do not recreate them—add equivalent rules in the existing policy and verify their order and counters.
Free tools Windows power users keep installed
One-click scans. No signup required.
Equivalent iptables forwarding pattern
When the host’s supported firewall tooling is based on iptables, the corresponding forwarding logic is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
iptables -A FORWARD -s <PRIVATE_CIDR> -o <WAN_IF> -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d <PRIVATE_CIDR> -i <WAN_IF> -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s <PRIVATE_CIDR> -o <WAN_IF> -j MASQUERADEUse this pattern only when iptables is the framework that owns the active policy. Persist it with the distribution’s supported firewall mechanism; rules entered interactively are otherwise commonly lost on reboot.
6. Point clients at the VPS and verify return routing
Each private client must either use the VPS private address as its default gateway or have a more-specific route through that address. On a Linux client, a temporary default-route change has this form:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →ip route replace default via <VPS_PRIVATE_IP> dev <PRIVATE_IF>Use a destination-specific route instead when only selected traffic should traverse the gateway:
ip route add <DESTINATION_CIDR> via <VPS_PRIVATE_IP> dev <PRIVATE_IF>Install the equivalent route in the client operating system’s persistent network configuration; the command above changes the running state only. Ensure the client’s own address and gateway are in a reachable subnet and that its DNS configuration points to a resolver it can reach through the new route.
For masquerade, Internet hosts see the VPS’s external address, so replies normally return to that address. For explicit SNAT to another address, verify the upstream route back to the VPS before testing applications. A one-way path is usually a routing or filtering problem, not a missing second NAT rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Persist, inspect, and test the configuration
Save the sysctl file and firewall configuration using the mechanisms supported by your distribution. On systems that load /etc/nftables.conf, an inspected ruleset can be exported there, but review it before replacing an existing policy:
nft list ruleset > /etc/nftables.confDo not treat that export as universally sufficient; service enablement and file locations differ by distribution. Confirm the saved configuration is loaded by the normal boot process, then perform a controlled reboot test.
Test in layers so a failure identifies the missing requirement:
- From the VPS, confirm Internet access through the external interface.
- From a client, ping or otherwise reach the VPS private-side address.
- From the client, test an Internet IP address. This avoids confusing DNS failure with routing failure.
- From the client, test name resolution after IP connectivity works.
- Inspect NAT and forward-chain counters while generating traffic.
- Repeat the checks after reboot and confirm
sysctl net.ipv4.ip_forwardis still1.
Optional: publish an internal service with DNAT
Outbound NAT is not required to expose an internal service, but inbound port publishing uses a different direction and chain. Create a prerouting NAT chain if one does not already exist, then translate only the intended ports:
nft 'add chain ip nat prerouting { type nat hook prerouting priority -100; policy accept; }'
nft add rule ip nat prerouting iifname "<WAN_IF>" tcp dport { 80, 443 } dnat to <INTERNAL_IP>Allow the corresponding inbound flow in the forward filter, restricted to the internal host and ports. Ensure the internal host’s replies return through the NAT gateway; with a dynamic external address, Red Hat’s documented approach combines DNAT with masquerade, while a fixed public address can use explicit SNAT. Expose only ports that the service and firewall policy intentionally support. A DNAT rule by itself does not override a dropped forward packet or repair an asymmetric return route.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Troubleshooting one-way traffic and failed connections
| Symptom | Likely cause | Checks and correction |
|---|---|---|
| The client cannot reach the Internet at all. | Missing client route, disabled forwarding, or a dropped forward packet. | Check the client’s ip route, verify net.ipv4.ip_forward is 1, then inspect the forward chain policy and counters. |
| Forward counters increase but NAT counters do not. | The postrouting rule does not match the actual source CIDR or output interface. | Compare the rule with ip -br addr, ip route get, and the client’s source address; correct <PRIVATE_CIDR> or <WAN_IF>. |
| Outbound packets leave, but replies never reach clients. | Asymmetric return routing, an incorrect static SNAT address, or stateful filtering. | For static SNAT, verify the upstream route to the translated address. Check established/related rules and capture both interfaces. |
| IP connectivity works but host names fail. | DNS traffic is not routed or the client is using an unreachable resolver. | Test an IP first, then inspect the client resolver and permit the required DNS traffic through the same path. |
| Rules work until reboot. | Interactive firewall rules or a temporary sysctl setting were never persisted. | Save the sysctl drop-in and firewall configuration with the distribution’s supported loader, then reboot-test. |
| Results change after adding another firewall tool. | Legacy iptables and nftables definitions are both active or are being translated by compatibility layers. | Inspect nft list ruleset and iptables-save; choose one owner for NAT and remove unintended duplicates. |
| A DNAT service receives no connections. | Missing prerouting rule, missing forward acceptance, or an internal host that replies through another gateway. | Check the prerouting rule, forward counters, the internal host’s route, and packet captures on both interfaces. |
Packet captures help distinguish routing from filtering. Run them on the private and external interfaces while making one test connection:
tcpdump -ni <PRIVATE_IF> host <CLIENT_IP>
tcpdump -ni <WAN_IF> host <DESTINATION_IP>Connection tracking inspection can show whether the kernel has state for the flow:
conntrack -LThe command may require the distribution’s connection-tracking utilities. Look for the original private tuple and its translated external tuple, then compare timestamps and reply packets on both captures.
Quick Recap
Operational and security considerations
- Scope NAT and forwarding rules to the intended private CIDR and interfaces rather than translating every packet on the VPS.
- Keep the forward policy restrictive when the VPS also hosts services; permit the private-to-external flow and established replies explicitly.
- Do not assume NAT is a security boundary. Services listening on the private network still need host-level authentication and firewall controls.
- Preserve an administrative access path before applying a default-drop policy, and test rules in a maintenance window when possible.
- Monitor rule counters and connection tracking during initial deployment. A rule that never increments is usually a topology or match problem.
- Use masquerade when the outgoing address is dynamic and explicit SNAT when a fixed source address makes the routing intent clearer.
Final validation sequence
- Confirm the private CIDR, private interface, and WAN interface from live routing output.
- Confirm persistent IPv4 forwarding and verify its value after a reboot.
- Confirm exactly one intended NAT framework owns the active rules.
- Confirm a postrouting masquerade or SNAT rule matches the private source range and WAN interface.
- Confirm forward acceptance for new private-to-WAN traffic and established WAN-to-private replies.
- Confirm every client has a default or specific route through the VPS.
- Generate a test flow, watch counters and captures on both interfaces, and check the return path.
- For inbound publishing, add narrowly scoped prerouting DNAT and matching forward acceptance only after outbound routing works.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
