---
name: "ss-nat"
section: "1"
platform: "linux"
package: "shadowsocks-libev"
version: "3.3.5+ds-16"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ss-nat"
---

# ss-nat(1)

helper script to setup NAT rules for transparent proxy

## NAME

ss-nat - helper script to setup NAT rules for transparent proxy

## SYNOPSIS

**ss-nat** \[-ouUfh\] \[-s *\<server\_ip\>*\] \[-S *\<server\_ip\>*\] \[-l *\<local\_port\>*\] \[-L *\<local\_port\>*\] \[-i *\<ip\_list\_file\>*\] \[-a *\<lan\_ips\>*\] \[-b *\<wan\_ips\>*\] \[-w *\<wan\_ips\>*\] \[-e *\<extra\_options\>*\]

## DESCRIPTION

**Shadowsocks-libev** is a lightweight and secure socks5 proxy. It is a port of the original shadowsocks created by clowwindy. **Shadowsocks-libev** is written in pure C and takes advantage of libev to achieve both high performance and low resource consumption.

[**ss-nat**(1)](/ss-nat/1.md) sets up NAT rules for [**ss-redir**(1)](/ss-redir/1.md) to provide traffic redirection. It requires netfilter’s NAT module and [**iptables**(8)](/iptables/8.md). For more information, check out [**shadowsocks-libev**(8)](/shadowsocks-libev/8.md) and the following *EXAMPLE* section.

## OPTIONS

- \-s *\<server\_ip\>*

  IP address of shadowsocks remote server

- \-l *\<local\_port\>*

  Port number of shadowsocks local server

- \-S *\<server\_ip\>*

  IP address of shadowsocks remote UDP server

- \-L *\<local\_port\>*

  Port number of shadowsocks local UDP server

- \-i *\<ip\_list\_file\>*

  a file whose content is bypassed ip list

- \-a *\<lan\_ips\>*

  LAN IP of access control, need a prefix to define access control mode

- \-b *\<wan\_ips\>*

  WAN IP of will be bypassed

- \-w *\<wan\_ips\>*

  WAN IP of will be forwarded

- \-e *\<extra\_options\>*

  Extra options for iptables

- \-o

  Apply the rules to the OUTPUT chain

- \-u

  Enable udprelay mode, TPROXY is required

- \-U

  Enable udprelay mode, using different IP and ports for TCP and UDP

- \-f

  Flush the rules

- \-h

  Show this help message and exit

## EXAMPLE

**ss-nat** requires [**iptables**(8)](/iptables/8.md). Here is an example:

```
# Enable NAT rules for shadowsocks,
# with both TCP and UDP redirection enabled,
# and applied for both PREROUTING and OUTPUT chains
root@Wrt:~# ss-nat -s 192.168.1.100 -l 1080 -u -o
# Disable and flush all NAT rules for shadowsocks
root@Wrt:~# ss-nat -f
```

## SEE ALSO

[**ss-local**(1)](/ss-local/1.md), [**ss-server**(1)](/ss-server/1.md), [**ss-tunnel**(1)](/ss-tunnel/1.md), [**ss-manager**(1)](/ss-manager/1.md), [**shadowsocks-libev**(8)](/shadowsocks-libev/8.md), [**iptables**(8)](/iptables/8.md), /etc/shadowsocks-libev/config.json