iptables MASQUERADE vs SNAT for traffic two hops away

Question

I have successfully used the rule:

iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE

to NAT traffic from a local 10.0.2.0 subnet out onto the internet (on the far side of eno1).

Traffic from a more distant 192.168.3.0 subnet (which came via a router on the 192.168.3 network) was NOT be NAT'ed when it went out onto the internet via this Linux router. Instead the outgoing packets retained their 192.168.3.x addresses and so received no replies from internet servers.

Replacing the MASQUERADE rule with:

iptables -t nat -A POSTROUTING -o eno1 -j SNAT --to 1.2.3.4

(where 1.2.3.4 is the Linux router's internet address on eno1) fixed the problem.

Should iptables MASQUERADE only rewrite packets that come from networks local to the Linux router, as was the case here? Or is there some other explanation?

Answer 1

That's very interesting, because man iptables-extensions says

Masquerading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down

So MASQUERADE is equivalent to SNAT, where --to is taken from the interface, and I am surprised you see a difference between those two wrt. forwarded packets.

In addition, I've used MASQUERADE for forwarded packets from network namespaces on my machine, and it works just fine.

So my first thought is that you are seeing some other effect, and I'd double check that it really was the different rule which made the difference, and not something else.