In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?

An example (taken from this answer) is:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.

I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.

Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.



Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html

Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html

All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.

For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/

I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.

FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias

  • like your first link that was --exactly-- what I am looking for :) – Mohammad Reza Rezwani May 15 '14 at 16:29
  • I've tested the MASUERADE rule (the third line in your code listing) and the link is exactly shared and available across interfaces. Therefore, I'm frustrated what is the FORWARD rule for? (the rule on the second line in your code listing) – 千木郷 Aug 23 at 3:07

MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).

  • What should be used when the IP address is known? – Luc Nov 28 '16 at 8:55
  • 4
    @Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this -j SNAT --to-source xx.xx.xx.xx where xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment. – Sergey P. aka azure Dec 6 '16 at 10:08

IP Masquerade is also known as Network Address Translation (NAT) and Network Connection Sharing some other popular operating systems. It is basically a method for allowing a computer that doesn't have a public Internet wide IP address communicate with other computers on the Internet with the help of another computer sitting inbetween it and the Internet.

As you know IP address are used on the Internet to identify machines. Given a packet with an IP address, every router that makes up the Internet knows where to send that packet to get it to its destination. Now, there are also a few ranges of IP addresses that have been reserved for private use inside Local Area Networks and other networks that are not directly connected to the Internet. These private addresses are guaranteed not to be in use on the public Internet.

This causes problems for machines that are connected to private networks are use private IP addresses, because they can't be connected directly to the Internet. They don't have an IP address that is allowed to be used on the public Internet. IP Masquerade solves this problem by allowing a machine with a private IP address to communicate with the Internet, while at the same time modifying the machine's packets to use a valid public IP address instead of the original private IP address. Packets returning from the Internet are modified back to use the original IP address before reaching private IP machine.

Note that this is not limited to the internet network masquerade/NAT can be used to route traffic from one network to an other let say and

Iptables masquerade rule can be replaced with SNAT rule

iptables -t nat -A POSTROUTING -o eth2 -s  -j MASQUERADE


iptables -t nat -A POSTROUTING -s -o eth2 -j SNAT --to-source
# supposing eth2 assigned ip is

Both masquerade and snat require ip_forward enabled at the kernel level with echo "1" > /proc/sys/net/ipv4/ip_forward or permanently by editing the settings file nano /etc/sysctl.conf.

IP Forward makes the machine act like a router and thus redirect/forward packets from all active interface logically by the targeted network (local/net/other/etc) or by following the route table. Note that enabling ip_forward may introduce important security risk, if ip_forward can not be avoided, it needs to be supervised/secured by additional iptables/route rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.