The MASQUERADE target is used basically the same as the
SNAT target, but it does not require any
--to-source option. The reason for this is that the
MASQUERADE target was made to work with, for example,
dial-up connections, or DHCP connections, which gets
dynamic IP addresses when connecting to the network in question. This means
that you should only use the MASQUERADE target with
dynamically assigned IP connections, which we don't know the actual address of
at all times. If you have a static IP connection, you should instead use the
SNAT target.
When you masquerade a connection, it means that we set the IP address used
on a specific network interface instead of the --to-source
option, and the IP address is automatically grabbed from the information about
the specific interface. The MASQUERADE target also has the
effect that connections are forgotten when an interface goes down, which is
extremely good if we, for example, kill a specific interface. If we would have
used the SNAT target, we may have been left with a lot of
old connection tracking data, which would be lying around for days, swallowing
up useful connection tracking memory. This is, in general, the correct
behavior when dealing with dial-up lines that are probably assigned a
different IP every time they are brought up. In case we are assigned a
different IP, the connection is lost anyways, and it is more or less idiotic to
keep the entry around.
It is still possible to use the MASQUERADE target instead
of SNAT even though you do have a static IP, however, it
is not favorable since it will add extra overhead, and there may be
inconsistencies in the future which will thwart your existing scripts and
render them "unusable".
Note that the MASQUERADE target is only valid within the
POSTROUTING chain in the nat table, just as the
SNAT target. The MASQUERADE target takes
one option specified below, which is optional.
Table 11-7. MASQUERADE target
| Option | --to-ports |
| Example | iptables -t nat -A POSTROUTING -p TCP -j MASQUERADE
--to-ports 1024-31000 |
| Explanation | The --to-ports option is used to set
the source port or ports to use on outgoing packets. Either you can specify a
single port like --to-ports 1025 or you may specify a port
range as --to-ports 1024-3000. In other words, the lower
port range delimiter and the upper port range delimiter separated with a
hyphen. This alters the default SNAT port-selection as described in the SNAT target section. The
--to-ports option is only valid if the rule match section
specifies the TCP or UDP protocols with the --protocol
match.
|
 | Works under Linux kernel 2.3, 2.4, 2.5 and 2.6.
|
