--- orig/etc/ferm/rules.ferm
+++ mod/etc/ferm/rules.ferm
@@ -1,5 +1,7 @@
 # -*- shell-script -*-
 
+def $HAVE_NAT = `grep --quiet --fixed-strings --line-regexp nat /proc/net/ip_tables_names && echo 1 || echo 0`;
+
 def &gen_net_tcp_udp_rules($name, $net_if, $net_ip, $tcp_services, $udp_services) = {
     def &_gen_net_tcp_udp_rules() = {
 	@if $net_if {
@@ -144,11 +146,13 @@
 	&output();
 	&forward();
     }
-    table nat {
-	chain POSTROUTING {
-	    @if $nat_net_ip {
-		saddr $nat_net_ip subchain "out_nat" {
-		    outerface $ext_interfaces &nat_method();
+    @if $HAVE_NAT {
+	table nat {
+	    chain POSTROUTING {
+		@if $nat_net_ip {
+		    saddr $nat_net_ip subchain "out_nat" {
+			outerface $ext_interfaces &nat_method();
+		    }
 		}
 	    }
 	}
