Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am confused what's the actual difference between SNAT and Masquerade?

If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?

share|improve this question
up vote 21 down vote accepted

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface is taken down and brought back up; the same is not true for the MASQUERADE target.

Good documents include the HOWTOs on the Netfilter site and the iptables man page.

share|improve this answer

Basically SNAT and MASQUERADE do the same source NAT thing in the nat table within the POSTROUTING chain.


  • MASQUERADE does not require --to-source as it was made to work with dynamically assigned IPs

  • SNAT works with static IPs, that's why it has --to-source

  • MASQUERADE has extra overhead and is slower than SNAT because each time MASQUERADE target gets hit by a packet, it has to check for the IP address to use.

IMPORTANT: It is still possible to use MASQUERADE target with static IP, just be aware of the extra overhead.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.