I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack).
I've a single simple
-t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j MASQUERADE rule, nothing else besides of ACCEPT policies on all chains, and it seems that
case 1) SYN packets of connection initialization attempts from 10.a/16 network get NAT-ed (this is OK), while
case 2) SYN/ACK packets again from 10.a/16 network (in response to SYN from 10.b/16, ie. the initiator is 10.b/16 in this case) do not get translated, but src address is kept as-is, simply routed.
I'm not sure is it the expected behaviour or i missed something? I mean I dont want it to behave any other way, everything seems working. but the documentation did not confirm to me that this is the factory-default behaviur of the MASQUERADE target.
Could you confirm it? thanks.