diff --git a/doc/ChangeLog b/doc/ChangeLog
index 2a0d32ae4..4d0da55ad 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,8 +1,12 @@
 2011-03-07  vadim  <vadim@netcitadel.com>
 
+	* IPTImporter.cpp (pushNATRule): see #2197 "iptables nat rules in
+	chain OUTPUT not imported correctly"
+
 	* iptables.g (nat_addr_range): see #2194 "iptables import problem
 	with SNAT rule translating to an address range". NAT rules
-	translating into address range did not import correctly
+	translating into address range with "-j SNAT --to-source
+	192.168.1.1-192.168.1.10" did not import correctly
 
 	* IPTImporter.cpp (pushNATRule): fixes #2195 "incorrect iptables
 	import of nat rule with NETMAP target"
diff --git a/src/libgui/IPTImporter.cpp b/src/libgui/IPTImporter.cpp
index d2231b05d..f58549577 100644
--- a/src/libgui/IPTImporter.cpp
+++ b/src/libgui/IPTImporter.cpp
@@ -1277,6 +1277,14 @@ void IPTImporter::pushNATRule()
     {
         rule_type = NATRule::DNAT;
 
+        // if chain is "OUTPUT", put fw object in OSrc
+        if (current_chain == "OUTPUT")
+        {
+            RuleElementOSrc *re = rule->getOSrc();
+            assert(re!=NULL);
+            re->addRef(getFirewallObject());
+        }
+
         FWObject *tdst = NULL;
         if (nat_addr1!=nat_addr2)
             tdst = createAddressRange(nat_addr1, nat_addr2);