My router has a public IP and my computer is in my LAN. So naturally I'm going to masquerade outbound(me -> Internet) traffic to make it possible to access the Internet. My settings:(I can't embed images yet...so please follow the link)

Pic: Firewall Zone Settings

In the picture, if I uncheck Masquerading in the second line, I'll lose my access to the Internet. And through iptables-save I found that the MASQUERADE target for the chain zone_nat_wan in the table nat is gone.

So here's my question: doesn't wan ⇒ lan mean the traffic from WAN to LAN? If not, what does it mean?

P.S. My router runs OpenWrt Attitude Adjustment 12.09.

  • Based on your image, I think you are doing something similar to me: trying to use the wifi as the wan. Could you add some comments as to what you had to do in the end to the firewall to get this working?
    – mallwright
    Jul 2, 2019 at 8:06

1 Answer 1


It depends(tm). The WAN Zone (WAN->LAN in your example) is about traffic from WAN to LAN for "Forward" (established connections), from LAN to WAN for "Output" and from WAN to LAN (all other packets) for "Input".

Masquerading is applied on outgoing packets of a specific interface by setting the source address of that packet to the interface address and using conntrack to save the state, therefore the developers opted to interpret this as "Masquerade WAN = Masquerade outgoing packets on the WAN interface". Of course one can argue that it would make more sense to enable masquerading on the LAN interface, since this is the network that is being masqueraded, so it's more a matter of perspective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.