diff --git a/enterprise/firewall/firewall.proto b/enterprise/firewall/firewall.proto
index c4dde2a..6b7413a 100644
--- a/enterprise/firewall/firewall.proto
+++ b/enterprise/firewall/firewall.proto
@@ -5,6 +5,7 @@ package enterprise.firewall;
 message FirewallConfig {
   FirewallPolicy default_policy = 2;
   repeated FirewallRule rules = 3;
+  repeated SnatBinding snat_bindings = 4;
 }
 
 enum IpVersion {
@@ -28,6 +29,13 @@ message FirewallRule {
   IpVersion ip_version = 8;
 }
 
+message SnatBinding {
+  int64 id = 1;
+  repeated IpAddress source_addrs = 2;
+  string public_ip = 3;
+  optional string comment = 4;
+}
+
 // IPv4 or IPv6 address
 // expected type is determined by a given FirewallRule
 message IpAddress {