I am confused what's the actual difference between SNAT and Masquerade?
If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
SNAT target requires you to give it an IP address to apply to all the outgoing packets. The
MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with
SNAT, the kernel's connection tracking keeps track of all the connections when the interface is taken down and brought back up; the same is not true for the
MASQUERADE do the same source NAT thingy in the
nat table within the
MASQUERADE does NOT require
--to-source as it was made to work with dynamically assigned IPs
SNAT works ONLY with static IPs, that's why it requires
MASQUERADE incurs extra overhead and is slower than
SNAT because each time
MASQUERADE target gets hit by a packet, it has to check for the IP address to use.
NOTE: A typical use case for
MASQUERADE: AWS EC2 instance in a VPC, it has a private IP within the VPC CIDR (e.g.
10.10.1.100 for example, it also has a public IP associated with it so as to communicate with the Internet (assume it is in a public subnet) through which the private IP does 1:1 NAT (AWS Network Infrastructure magic). The public IP may change after instance power cycles - stop then start (if NOT an EIP),
MASQUERADE is a better option in this use case.
Important: It is still possible to use
MASQUERADE target with static IP, just be aware of the extra overhead.
Short answer: use SNAT
Explanation: I just tried removing the masquerade rule on my raspbian router (which speaks to another router, via eth0 where the interfaces IP address is 192.168.8.2 and is static) and the internet sharing continued to work. The commands I tried were:-
iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.8.2