iptables-restore iptables.snat

# sys_firewall::default disables iptables when node[:sys_firewall][:enabled]==disabled