diff --git a/applications/luci-app-ap-modem/htdocs/luci-static/resources/view/ap_modem.js b/applications/luci-app-ap-modem/htdocs/luci-static/resources/view/ap_modem.js
index a54386702..c3d7021e8 100644
--- a/applications/luci-app-ap-modem/htdocs/luci-static/resources/view/ap_modem.js
+++ b/applications/luci-app-ap-modem/htdocs/luci-static/resources/view/ap_modem.js
@@ -21,9 +21,24 @@ return view.extend({
         s.anonymous = true;
         s.addremove = false;
 
+
         o = s.option(form.Flag, 'enabled', _('Enable'));
         o.rmempty  = false;
 
+        o = s.option(form.Flag, 'snat_enabled', _('Enable SNAT for modem management'));
+        o.rmempty = false;
+        o.default = o.disabled;
+
+        o = s.option(form.Value, 'snat_dest_ip', _('SNAT destination IP'), _('Usually modem management IP, e.g. 192.168.1.1'));
+        o.datatype = 'ip4addr';
+        o.placeholder = '192.168.1.1';
+        o.depends('snat_enabled', '1');
+
+        o = s.option(form.Value, 'snat_ip', _('SNAT source IP'), _('Usually one WAN virtual IP on modem subnet, e.g. 192.168.1.254'));
+        o.datatype = 'ip4addr';
+        o.placeholder = '192.168.1.254';
+        o.depends('snat_enabled', '1');
+
         s = m.section(form.NamedSection, 'config', 'ap_modem', _('Interface Settings'));
         s.anonymous = true;
         s.addremove = false;
diff --git a/applications/luci-app-ap-modem/po/zh-cn/ap-modem.po b/applications/luci-app-ap-modem/po/zh-cn/ap-modem.po
index a8b059429..6dec2a192 100644
--- a/applications/luci-app-ap-modem/po/zh-cn/ap-modem.po
+++ b/applications/luci-app-ap-modem/po/zh-cn/ap-modem.po
@@ -41,3 +41,19 @@ msgstr "<br>例如，你想要访问光猫后台，它的IP地址是192.168.1.1
 
 msgid "Supports \"IP/MASK\", \"IP/PREFIX\", and pure \"IP\" format, pure \"IP\" assumes a prefix of 24 bits"
 msgstr "支持“IP/掩码”、“IP/前缀长度”、以及纯“IP”格式，纯“IP”则假设前缀24位"
+
+
+msgid "Enable SNAT for modem management"
+msgstr "启用访问光猫管理页的SNAT"
+
+msgid "SNAT destination IP"
+msgstr "SNAT目标IP"
+
+msgid "Usually modem management IP, e.g. 192.168.1.1"
+msgstr "通常为光猫管理IP，例如 192.168.1.1"
+
+msgid "SNAT source IP"
+msgstr "SNAT源IP"
+
+msgid "Usually one WAN virtual IP on modem subnet, e.g. 192.168.1.254"
+msgstr "通常为光猫网段中的一个WAN虚拟IP，例如 192.168.1.254"
diff --git a/applications/luci-app-ap-modem/root/etc/config/ap_modem b/applications/luci-app-ap-modem/root/etc/config/ap_modem
index 7f1957de8..ba43e3741 100644
--- a/applications/luci-app-ap-modem/root/etc/config/ap_modem
+++ b/applications/luci-app-ap-modem/root/etc/config/ap_modem
@@ -1,5 +1,8 @@
 config ap_modem 'config'
     option enabled '0'
+    option snat_enabled '0'
+    option snat_dest_ip '192.168.1.1'
+    option snat_ip '192.168.1.254'
 
 config interface 'lan'
     # list ipaddr '192.168.31.254'
diff --git a/applications/luci-app-ap-modem/root/etc/init.d/ap_modem b/applications/luci-app-ap-modem/root/etc/init.d/ap_modem
index 78ff7a8ba..9ea07c1f6 100755
--- a/applications/luci-app-ap-modem/root/etc/init.d/ap_modem
+++ b/applications/luci-app-ap-modem/root/etc/init.d/ap_modem
@@ -103,6 +103,26 @@ EOF
     echo "$fw_wan_net" | grep -Fwq 'vap_wan' || uci -q batch <<-EOF >/dev/null
         add_list firewall.$wan_zone.network=vap_wan
 EOF
+
+    local snat_enabled
+    local snat_dest_ip
+    local snat_ip
+    config_get_bool snat_enabled "config" snat_enabled 0
+    config_get snat_dest_ip "config" snat_dest_ip
+    config_get snat_ip "config" snat_ip
+    if [[ "$snat_enabled" = "1" && -n "$snat_dest_ip" && -n "$snat_ip" ]]; then
+        uci -q batch <<-EOF >/dev/null
+            set firewall.ap_modem_snat=nat
+            set firewall.ap_modem_snat.name=ap_modem_snat_to_modem
+            set firewall.ap_modem_snat.family=ipv4
+            set firewall.ap_modem_snat.src=lan
+            set firewall.ap_modem_snat.dest_ip=$snat_dest_ip
+            set firewall.ap_modem_snat.target=SNAT
+            set firewall.ap_modem_snat.snat_ip=$snat_ip
+EOF
+    else
+        uci -q delete firewall.ap_modem_snat
+    fi
     uci commit firewall
 
     # ip
@@ -169,8 +189,9 @@ clean_config() {
     [[ -z "$wan_zone" ]] || uci -q batch <<-EOF >/dev/null
         del_list firewall.$wan_zone.network=vap_lan
         del_list firewall.$wan_zone.network=vap_wan
-        commit firewall
 EOF
+    uci -q delete firewall.ap_modem_snat
+    uci -q commit firewall
     local lan_dev=`find_uci_section network device name 'br-lan' | head -1`
     [[ -z "$lan_dev" ]] || {
         uci del_list "network.$lan_dev.ports=vap-lan"