I was having trouble getting NAT working on a Debian server which was going to act as a gateway for my private physical network. I tried to many different versions of tips and none got all the pieces right.
Until I found this amazing generator script. The questions were easy to answer and very robust in terms of understanding what I wanted. The best part, it created this script which ran totally perfect. It created a perfect firewall, blocks everything except what I want open, provides NAT and port forwarding for incoming services.
The link to this amazing script, for which I am not the author, is http://easyfwgen.morizot.net/gen/