Confused about OpenWRT's Firewall Zone Settings Definition

Question

My router has a public IP and my computer is in my LAN. So naturally I'm going to masquerade outbound(me -> Internet) traffic to make it possible to access the Internet. My settings:(I can't embed images yet...so please follow the link)

Pic: Firewall Zone Settings

In the picture, if I uncheck Masquerading in the second line, I'll lose my access to the Internet. And through iptables-save I found that the MASQUERADE target for the chain zone_nat_wan in the table nat is gone.

So here's my question: doesn't wan ⇒ lan mean the traffic from WAN to LAN? If not, what does it mean?

P.S. My router runs OpenWrt Attitude Adjustment 12.09.

Answer 1

It depends(tm). The WAN Zone (WAN->LAN in your example) is about traffic from WAN to LAN for "Forward" (established connections), from LAN to WAN for "Output" and from WAN to LAN (all other packets) for "Input".

Masquerading is applied on outgoing packets of a specific interface by setting the source address of that packet to the interface address and using conntrack to save the state, therefore the developers opted to interpret this as "Masquerade WAN = Masquerade outgoing packets on the WAN interface". Of course one can argue that it would make more sense to enable masquerading on the LAN interface, since this is the network that is being masqueraded, so it's more a matter of perspective.