diff --git a/src/test/test-firewall-util.c b/src/test/test-firewall-util.c
index c5a138ee1e..d2843cfab7 100644
--- a/src/test/test-firewall-util.c
+++ b/src/test/test-firewall-util.c
@@ -61,6 +61,13 @@ static bool test_v4(FirewallContext *ctx) {
 
         log_info("/* %s(backend=%s) */", __func__, firewall_backend_to_string(ctx->backend));
 
+#if HAVE_LIBIPTC
+        if (ctx->backend == FW_BACKEND_IPTABLES && fw_iptables_init_nat(NULL) < 0) {
+                log_debug("iptables backend is used, but nat table is not enabled, skipping tests");
+                return false;
+        }
+#endif
+
         assert_se(fw_add_masquerade(&ctx, true, AF_INET, NULL, 0) == -EINVAL);
         assert_se(fw_add_masquerade(&ctx, true, AF_INET, parse_addr("10.1.2.0", &u), 0) == -EINVAL);
 
@@ -102,11 +109,6 @@ int main(int argc, char *argv[]) {
         if (ctx->backend == FW_BACKEND_NONE)
                 return EXIT_TEST_SKIP;
 
-#if HAVE_LIBIPTC
-        if (ctx->backend == FW_BACKEND_IPTABLES && fw_iptables_init_nat(NULL) < 0)
-                return EXIT_TEST_SKIP;
-#endif
-
         if (test_v4(ctx) && ctx->backend == FW_BACKEND_NFTABLES)
                 test_v6(ctx);