Set up NAT and routing

Set up NAT and routing so the internal lab subnet 172.16.4.0/24 can reach the Internet through router-gw-1. Add masquerade rules on the gateway, create a static route on router-gw-1 for 172.16.4.0/24 via 10.1.8.2, ensure forwarding is enabled and saved, test outbound connections from a lab VM, and document the commands used in the network ticket.

Before I apply the NAT change, make approval easy: put the outbound IP and which services will be reachable up front, show the exact iptables or nft commands and the rollback commands, highlight security risks such as open ports forwarded from Internet, and note whether hairpin NAT is required for internal services.

I added masquerade on the gateway and enabled forwarding, but lab VMs still fail to reach external sites. I suspect a missing default route on the gateway, a conflicting firewall rule, or reverse path filtering. What is the most likely diagnosis and the quickest checks and fixes to restore outbound connectivity immediately?

Every time we add NAT for a new subnet, something else stops: routes missing, firewall policies too permissive, or no monitoring of SNAT counts. What one habit change and one small automated test would prevent most of these mistakes and keep our routing predictable?