CentOS 7 as NAT Gateway for Private Network

The scenario is a small private network connected via a switch and using 192.168.0.* addresses. One of the machines (let’s call it RTR001) on the network has two network interface cards. One with an address on the 192.168.0.* network and another providing wider network (& internet) access on a 123.111.123.* network. This machine (RTR001) will take traffic from the private network 192.168.0.* and route it out via its other interface to the internet etc.

So the router machine (RTR001) has the following interfaces and IP addresses:

  • eth0
  • eth1

Configure the kernel to forward IP packets:

To avoid rebooting implement the same change dynamically:

On CentOS 7, after configuring both network interfaces, we need to use firewalld:

After making changes reload with:

Check the settings to ensure your interfaces are listed in the correct zone:

If you have made a mistake you can remove the interface from the zone with:

Configure masquerading on the externally facing device (eth0):

Now the NAT rule:

I was running DNS, DHCP, pxe and several other services from my RTR001 machine to service the internal computers so I opened those ports with:

Reload the firewall rules and test pings from the internal machines:


5 Responses to “CentOS 7 as NAT Gateway for Private Network”

  1. a123qwertz567

    Thank you for your manual. Worked fine for me until a reboot. After I rebooted the machine all network devices are assigned to the default zone. It doesnt matter if I configure it with the command line or with the firewalld-GUI.

    May you have any idea what I could do?

    • a123qwertz567

      I fixed this by adding


      to the file /etc/sysconfig/network-scripts/ifcfg-eno1

  2. Jamie Fargen

    In RHEL7.3, the commands firewall-cmd –zone=external –add-interface=eth0 –permanent seem to append the zone to the network config file /etc/sysconfig/network-scripts/ifcfg-xyz automatically now.

  3. Michael

    You don’t need to reboot if you changed /etc/sysctl.conf, just execute the following command to reload it;
    sysctl -p


Leave a Reply

  • (will not be published)

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">