diff --git a/doc/language_issues.es b/doc/language_issues.es
index da8f60691..f04d622f5 100644
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -593,7 +593,9 @@ WARNING: untranslated string: ccd none
 WARNING: untranslated string: ccd routes
 WARNING: untranslated string: ccd subnet
 WARNING: untranslated string: ccd used
+WARNING: untranslated string: default ip
 WARNING: untranslated string: deprecated fs warn
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
 WARNING: untranslated string: dnsforward configuration
@@ -663,6 +665,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -816,6 +820,7 @@ WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
 WARNING: untranslated string: server restart
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: static routes
 WARNING: untranslated string: system information
 WARNING: untranslated string: tor
diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 9cd6c2f26..0483c27e8 100644
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -595,7 +595,9 @@ WARNING: untranslated string: ccd none
 WARNING: untranslated string: ccd routes
 WARNING: untranslated string: ccd subnet
 WARNING: untranslated string: ccd used
+WARNING: untranslated string: default ip
 WARNING: untranslated string: deprecated fs warn
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dns address deleted txt
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
@@ -666,6 +668,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -806,6 +810,7 @@ WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
 WARNING: untranslated string: server restart
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: snort working
 WARNING: untranslated string: static routes
 WARNING: untranslated string: system information
diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index e472cdf0e..2ebb0a5e1 100644
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -561,6 +561,8 @@ WARNING: untranslated string: age sminute
 WARNING: untranslated string: age ssecond
 WARNING: untranslated string: bytes
 WARNING: untranslated string: ccd iroute2
+WARNING: untranslated string: default ip
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
 WARNING: untranslated string: dnsforward configuration
@@ -612,6 +614,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -726,6 +730,7 @@ WARNING: untranslated string: route config changed
 WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: tor
 WARNING: untranslated string: tor accounting
 WARNING: untranslated string: tor accounting bytes
diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index da8f60691..f04d622f5 100644
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -593,7 +593,9 @@ WARNING: untranslated string: ccd none
 WARNING: untranslated string: ccd routes
 WARNING: untranslated string: ccd subnet
 WARNING: untranslated string: ccd used
+WARNING: untranslated string: default ip
 WARNING: untranslated string: deprecated fs warn
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
 WARNING: untranslated string: dnsforward configuration
@@ -663,6 +665,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -816,6 +820,7 @@ WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
 WARNING: untranslated string: server restart
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: static routes
 WARNING: untranslated string: system information
 WARNING: untranslated string: tor
diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 1ddcedc71..a58e73265 100644
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -588,8 +588,10 @@ WARNING: untranslated string: ccd routes
 WARNING: untranslated string: ccd subnet
 WARNING: untranslated string: ccd used
 WARNING: untranslated string: community rules
+WARNING: untranslated string: default ip
 WARNING: untranslated string: deprecated fs warn
 WARNING: untranslated string: disk access per
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
 WARNING: untranslated string: dnsforward configuration
@@ -649,6 +651,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -788,6 +792,7 @@ WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
 WARNING: untranslated string: server restart
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: static routes
 WARNING: untranslated string: tor
 WARNING: untranslated string: tor accounting
diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 4e4fd8c35..d207286dd 100644
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -558,6 +558,8 @@ WARNING: untranslated string: Scan for Songs
 WARNING: untranslated string: advproxy errmsg proxy ports equal
 WARNING: untranslated string: advproxy proxy port transparent
 WARNING: untranslated string: bytes
+WARNING: untranslated string: default ip
+WARNING: untranslated string: dnat address
 WARNING: untranslated string: dnsforward
 WARNING: untranslated string: dnsforward add a new entry
 WARNING: untranslated string: dnsforward configuration
@@ -609,6 +611,8 @@ WARNING: untranslated string: fwdfw external port nat
 WARNING: untranslated string: fwdfw final_rule
 WARNING: untranslated string: fwdfw hint ip1
 WARNING: untranslated string: fwdfw hint ip2
+WARNING: untranslated string: fwdfw iface
+WARNING: untranslated string: fwdfw log
 WARNING: untranslated string: fwdfw log rule
 WARNING: untranslated string: fwdfw menu
 WARNING: untranslated string: fwdfw movedown
@@ -722,6 +726,7 @@ WARNING: untranslated string: route config changed
 WARNING: untranslated string: routing config added
 WARNING: untranslated string: routing config changed
 WARNING: untranslated string: routing table
+WARNING: untranslated string: snat new source ip address
 WARNING: untranslated string: tor
 WARNING: untranslated string: tor accounting
 WARNING: untranslated string: tor accounting bytes
diff --git a/doc/language_missings b/doc/language_missings
index 13f8a5f86..6bdfffb8f 100644
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -59,7 +59,9 @@
 < ccd routes
 < ccd subnet
 < ccd used
+< default ip
 < deprecated fs warn
+< dnat address
 < dns address deleted txt
 < dnsforward
 < dnsforward add a new entry
@@ -126,7 +128,9 @@
 < fwdfw from
 < fwdfw hint ip1
 < fwdfw hint ip2
+< fwdfw iface
 < fwdfw ipsec network
+< fwdfw log
 < fwdfw log rule
 < fwdfw man port
 < fwdfw menu
@@ -292,6 +296,7 @@
 < qos enter bandwidths
 < red1
 < server restart
+< snat new source ip address
 < snort working
 < static routes
 < system information
@@ -464,7 +469,9 @@
 < ccd routes
 < ccd subnet
 < ccd used
+< default ip
 < deprecated fs warn
+< dnat address
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
@@ -530,7 +537,9 @@
 < fwdfw from
 < fwdfw hint ip1
 < fwdfw hint ip2
+< fwdfw iface
 < fwdfw ipsec network
+< fwdfw log
 < fwdfw log rule
 < fwdfw man port
 < fwdfw menu
@@ -713,6 +722,7 @@
 < red1
 < server restart
 < Set time on boot
+< snat new source ip address
 < static routes
 < system information
 < tor
@@ -860,7 +870,9 @@
 < ccd routes
 < ccd subnet
 < ccd used
+< default ip
 < deprecated fs warn
+< dnat address
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
@@ -918,7 +930,9 @@
 < fwdfw from
 < fwdfw hint ip1
 < fwdfw hint ip2
+< fwdfw iface
 < fwdfw ipsec network
+< fwdfw log
 < fwdfw log rule
 < fwdfw man port
 < fwdfw menu
@@ -1086,6 +1100,7 @@
 < qos enter bandwidths
 < red1
 < server restart
+< snat new source ip address
 < static routes
 < tor
 < tor 0 = disabled
@@ -1234,8 +1249,10 @@
 < ccd subnet
 < ccd used
 < day-graph
+< default ip
 < deprecated fs warn
 < disk access per
+< dnat address
 < dnsforward
 < dnsforward add a new entry
 < dnsforward configuration
@@ -1295,7 +1312,9 @@
 < fwdfw from
 < fwdfw hint ip1
 < fwdfw hint ip2
+< fwdfw iface
 < fwdfw ipsec network
+< fwdfw log
 < fwdfw log rule
 < fwdfw man port
 < fwdfw menu
@@ -1463,6 +1482,7 @@
 < qos enter bandwidths
 < red1
 < server restart
+< snat new source ip address
 < static routes
 < tor
 < tor 0 = disabled
diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
index 5d58713ab..e5a6eeed6 100755
--- a/html/cgi-bin/firewall.cgi
+++ b/html/cgi-bin/firewall.cgi
@@ -1661,6 +1661,7 @@ END
 		&gen_dd_block('src','grp1');
 		print"<hr>";
 		&Header::closebox();
+
 		#---SNAT / DNAT ------------------------------------------------
 		&Header::openbox('100%', 'left', 'NAT');
 		print<<END;
@@ -1671,39 +1672,75 @@ END
 			<div class="NAT">
 				<table width='100%' border='0'>
 					<tr>
-						<td colspan='2'></td>
-						<td width='1%'>
-							<input type='radio' name='nat' id='dnat' value='dnat' checked>
+						<td width='5%'></td>
+						<td width='40%'>
+							<label>
+								<input type='radio' name='nat' id='dnat' value='dnat' checked>
+								$Lang::tr{'fwdfw dnat'}
+							</label>
 						</td>
-						<td width='50%'>$Lang::tr{'fwdfw dnat'}</td>
 END
-		print"<td width='8%'>Firewall: </td><td width='20%' align='right'><select name='dnat' style='width:140px;'>";
-		print "<option value='ALL' $selected{'dnat'}{$Lang::tr{'all'}}>$Lang::tr{'all'}</option>";
-		print "<option value='Default IP' $selected{'dnat'}{'Default IP'}>Default IP</option>";
-		foreach my $alias (sort keys %aliases)
-		{
-			print "<option value='$alias' $selected{'dnat'}{$alias}>$alias</option>";
-		}
-		print"</select></td></tr>";
-		#SNAT
-		print"<tr><td colspan='2'></td><td width='1%'><input type='radio' name='nat' id='snat' value='snat'  $checked{'nat'}{'snat'}></td><td width='20%'>$Lang::tr{'fwdfw snat'}</td>";
-		print"<td width='8%'>Firewall: </td><td width='20%' align='right'><select name='snat' style='width:140px;'>";
-		foreach my $alias (sort keys %aliases)
-			{
-				print "<option value='$alias' $selected{'snat'}{$alias}>$alias</option>";
+
+		if (%aliases) {
+			print <<END;
+						<td width='25%' align='right'>$Lang::tr{'dnat address'}:</td>
+						<td width='30%'>
+							<select name='dnat' style='width: 100%;'>
+								<option value='Default IP' $selected{'dnat'}{'Default IP'}>$Lang::tr{'default ip'}</option>
+END
+			foreach my $alias (sort keys %aliases) {
+				print "<option value='$alias' $selected{'dnat'}{$alias}>$alias</option>";
 			}
-		foreach my $network (sort keys %defaultNetworks)
-		{
+
+			print "</select>";
+		} else {
+			print <<END;
+						<td colspan="2" width='55%'>
+							<input type='hidden' name='dnat' value='Default IP'>
+						</td>
+END
+		}
+		print "</tr>";
+
+		#SNAT
+		print <<END;
+					<tr>
+						<td width='5%'></td>
+						<td width='40%'>
+							<label>
+								<input type='radio' name='nat' id='snat' value='snat' $checked{'nat'}{'snat'}>
+								$Lang::tr{'fwdfw snat'}
+							</label>
+						</td>
+						<td width='25%' align='right'>$Lang::tr{'snat new source ip address'}:</td>
+						<td width='30%'>
+							<select name='snat' style='width: 100%;'>
+END
+
+		foreach my $alias (sort keys %aliases) {
+			print "<option value='$alias' $selected{'snat'}{$alias}>$alias</option>";
+		}
+
+		# XXX this is composed in a very ugly fashion
+		foreach my $network (sort keys %defaultNetworks) {
 			next if($defaultNetworks{$network}{'NAME'} eq "IPFire");
 			next if($defaultNetworks{$network}{'NAME'} eq "ALL");
 			next if($defaultNetworks{$network}{'NAME'} =~ /OpenVPN/i);
+
 			print "<option value='$defaultNetworks{$network}{'NAME'}'";
 			print " selected='selected'" if ($fwdfwsettings{$fwdfwsettings{'nat'}} eq $defaultNetworks{$network}{'NAME'});
 			print ">$network</option>";
 		}
-		print"</select></td></tr></table>";
-		print"</div>";
+
+		print <<END;
+							</select>
+						</td>
+					</tr>
+				</table>
+			</div>
+END
 		&Header::closebox();
+
 		#---TARGET------------------------------------------------------
 		&Header::openbox('100%', 'left', $Lang::tr{'fwdfw target'});
 		print<<END;
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index 6b38be8de..002a4a5f6 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -617,6 +617,7 @@
 'december' => 'Dezember',
 'deep scan directories' => 'rekursiv scannen',
 'def lease time' => 'Standardzeit für Zuordnung',
+'default ip' => 'Standard IP-Adresse',
 'default lease time' => 'Haltezeit-Voreinstellung in min:',
 'default networks' => 'Standard Netzwerke',
 'default renewal time' => 'Standard-Aktualisierungszeit',
@@ -696,6 +697,7 @@
 'dmz pinhole rule added' => 'Regel für DMZ-Schlupfloch hinzugefügt; Starte DMZ-Schlupfloch neu',
 'dmz pinhole rule removed' => 'Regel für DMZ-Schlupfloch entfernt; Starte DMZ-Schlupfloch neu',
 'dmzpinholes for same net not necessary' => 'DMZ-Schlupflöcher werden im gleichen Netz nicht benötigt. Wählen Sie ein anderes Quell- oder Ziel-Netz.',
+'dnat address' => 'Externe IP-Adresse',
 'dns address deleted' => 'Erfolgreich gelöscht! ',
 'dns address deleted txt' => 'DNS Server Adressen wurden erfolgreich gelöscht. Änderungen werden jedoch erst nach einem Neustart oder einer Wiederverbindung übernommen.',
 'dns address done' => 'Die DNS-Server Adressen Einstellungen werden übernommen.',
@@ -1860,6 +1862,7 @@
 'smbstop' => 'Samba Dienste beenden',
 'smtphost' => 'Smtp Host',
 'smtpport' => 'Smtp Port',
+'snat new source ip address' => 'Neue Quell-IP-Adresse',
 'snort hits' => 'Gesamtanzahl der aktivierten Intrusion-Regeln für',
 'snort working' => 'Snort führt gerade eine Aufgabe aus... Bitte warten Sie, bis diese erfolgreich beendet wurde.',
 'socket options' => 'Socket Options',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index af5baca49..44e8697be 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -638,6 +638,7 @@
 'december' => 'December',
 'deep scan directories' => 'Scan recursive',
 'def lease time' => 'Default Lease Time',
+'default ip' => 'Default IP address',
 'default lease time' => 'Default lease time (mins):',
 'default networks' => 'Default networks',
 'default renewal time' => 'Default Renewal Time',
@@ -719,6 +720,7 @@
 'dmz pinhole rule added' => 'DMZ pinhole rule added; restarting DMZ pinhole',
 'dmz pinhole rule removed' => 'DMZ pinhole rule removed; restarting DMZ pinhole',
 'dmzpinholes for same net not necessary' => 'DMZ Pinholes are not necessary for same net. Select different source or destination net.',
+'dnat address' => 'External IP address',
 'dns address deleted' => 'Successfully deleted!',
 'dns address deleted txt' => 'The DNS-Server addresses have been successfully deleted.<br />You have to reboot or reconnect that the changes have effect!',
 'dns address done' => 'The DNS-Server address settings are going to be saved.',
@@ -1894,6 +1896,7 @@
 'smbstop' => 'Stop samba',
 'smtphost' => 'SMTP host',
 'smtpport' => 'SMTP port',
+'snat new source ip address' => 'New source IP address',
 'snort hits' => 'Total of number of Intrusion rules activated for',
 'snort working' => 'Snort is working ... Please wait until all operations have completed successfully.',
 'socket options' => 'Socket options',