In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?

An example (taken from this answer) is:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

3 Answers 3


It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.

I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.

Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.



Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html

Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html

All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.

For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/

I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.

FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias

  • like your first link that was --exactly-- what I am looking for :) Commented May 15, 2014 at 16:29
  • 2
    I've tested the MASUERADE rule (the third line in your code listing) and the link is exactly shared and available across interfaces. Therefore, I'm frustrated what is the FORWARD rule for? (the rule on the second line in your code listing)
    – 千木郷
    Commented Aug 23, 2019 at 3:07

MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).

  • 1
    What should be used when the IP address is known?
    – Luc
    Commented Nov 28, 2016 at 8:55
  • 9
    @Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this -j SNAT --to-source xx.xx.xx.xx where xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment. Commented Dec 6, 2016 at 10:08

After study of above answers, this is what caused me to understand:

Masquerading allows an entire network of internal IP addresses to operate through one external IP address. As a side effect, masquerading allows conversion from one protocol to another (wired/wireless).

When the MASQUERADE chain sends a datagram from a computer it...

  1. Takes note of the type of datagram it is, "TCP," "UDP," "ICMP," etc. Note: An unknown might not work correctly through MASQUERADE.
  2. Modifies the datagram so that it looks like it was generated by the router machine itself (the one external address).
  3. Remembers that it has done so, recording the local source and external destination IPs.
  4. Transmits the datagram onto the Internet with the single external IP address.

Note: When the destination host receives this datagram, it believes the datagram has come from the one routing host and sends any reply datagrams back to that address.

When the Linux MASQUERADE chain receives a datagram from its Internet connection,

  1. It looks in its table of established masqueraded connections to see if this datagram actually belongs to a computer on the LAN.
  2. If it does, it reverses the modification it did on the forward path and transmits the datagram to the LAN computer.

The MASQUERADE chain is useful for internally creating and entire private IP address space, and for forwarding packets that would otherwise be incompatible.

The Ethernet, or wired protocol, assumes that the packet comes from the source and reports itself. The Wifi, or wireless protocol, assumes that the packet is being repeated and reports itself and the original source.

For this reason, Wifi and Ethernet cannot be directly bridged because they are incompatible. Masquerading causes the packets to be rebuilt and will thereby handle conversion between wired and wireless standards. Note: There are ways to cause your computer to accept the incompatibility internally and bridge, but without a full masquerade, the bridge spoof will be viewed externally as a security risk and those requests will be rejected.

  • 3
    Good explanation, but technically, MASQUERADE is a target, not a chain.
    – toppur
    Commented Oct 10, 2021 at 2:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .