I have successfully used the rule:
iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE
to NAT traffic from a local 10.0.2.0 subnet out onto the internet (on the far side of eno1).
Traffic from a more distant 192.168.3.0 subnet (which came via a router on the 192.168.3 network) was NOT be NAT'ed when it went out onto the internet via this Linux router. Instead the outgoing packets retained their 192.168.3.x addresses and so received no replies from internet servers.
Replacing the MASQUERADE rule with:
iptables -t nat -A POSTROUTING -o eno1 -j SNAT --to 18.104.22.168
(where 22.214.171.124 is the Linux router's internet address on eno1) fixed the problem.
Should iptables MASQUERADE only rewrite packets that come from networks local to the Linux router, as was the case here? Or is there some other explanation?