65

I am confused what's the actual difference between SNAT and Masquerade?

If I want to share my internet connection on local network, should I select SNAT or Masquerade?

Improve this question

3 Answers 3

Reset to default
61

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface is taken down and brought back up; the same is not true for the MASQUERADE target.

Good documents include the HOWTOs on the Netfilter site and the iptables man page.

Improve this answer
3
  • 5
    I'm having trouble understanding the benefit of SNAT. Why does it matter if the kernel tracks connections or not when the interface goes down? Regarding MASQUERADE, the netfilter docs say "But more importantly, if the link goes down, the connections (which are now lost anyway) are forgotten, meaning fewer glitches when connection comes back up with a new IP address." Sounds reasonable (although what are the glitches?) Now looking at SNAT, what is the benefit of tracking lost connections? Why not use MASQUERADE every time?
    – Carl G
    Nov 9, 2016 at 12:29
  • 1
    @CarlG, I guess the glitches would occur with the permanently tracked -j SNAT (as opposed to the recycling tracking with -j MASQUERADE) when a new outgoing connection from a LAN node uses the same source port number as the severed outgoing connection from the same LAN node. In that case, I can imagine incoming packets from the old outgoing connection getting sent to the node, confusing its TCP stack. As for the benefit of -j SNAT, what if the NAT box is configured with the same external IP address and the kernel keeps forwarding packets from old connections instead of replying with RST?
    – eel ghEEz
    Mar 18, 2018 at 14:50
  • 1
    SNAT is useful, if for example you have multiple IP addresses assigned to the outgoing interface and want the NAT source to be a particular one of these.
    – pgoetz
    Feb 9, 2019 at 2:09
43

SNAT and MASQUERADE do the same source NAT thingy in the nat table within the POSTROUTING chain.

Differences

  • MASQUERADE does NOT require --to-source as it was made to work with dynamically assigned IPs

  • SNAT works ONLY with static IPs, that's why it requires --to-source

  • MASQUERADE incurs extra overhead and is slower than SNAT because each time MASQUERADE target gets hit by a packet, it has to check for the IP address to use.

NOTE: A typical use case for MASQUERADE: AWS EC2 instance in a VPC, it has a private IP within the VPC CIDR (e.g. 10.10.1.0/24) - 10.10.1.100 for example, it also has a public IP associated with it so as to communicate with the Internet (assume it is in a public subnet) through which the private IP does 1:1 NAT (AWS Network Infrastructure magic). The public IP may change after instance power cycles - stop then start (if NOT an EIP), MASQUERADE is a better option in this use case.

Important: It is still possible to use MASQUERADE target with static IP, just be aware of the extra overhead.

References

Improve this answer
4

Short answer: use SNAT

Explanation: I just tried removing the masquerade rule on my raspbian router (which speaks to another router, via eth0 where the interfaces IP address is 192.168.8.2 and is static) and the internet sharing continued to work. The commands I tried were:-

iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.8.2
Improve this answer
1
  • 1
    Can you give a more detailed explanation why removing the masqerading ist not sufficient? What else is missing then? Or can't masqerading be disabled again and only SNAT can??
    – Axel Heider
    Aug 25, 2022 at 0:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .