What is a difference and why should we use SNAT instead of MASQUERADE.
According to official documentation:
There is a specialized case of Source NAT called masquerading: it should only be used for dynamically-assigned IP addresses, such as standard dialups (for static IP addresses, use SNAT above).
With SNAT, the kernel’s connection tracking keeps track of all the connections when the interface is taken down and brought back up. For the MASQUERADE target connection will be lost.
With MASQUERADE some issues can occur if your have more than one ip on outgoing interface.
With MASQUERADE kernel determine nat outgoing ip address for every connection (it looks for interface IP) it`s rather expensive operation.
But in 99.99% cases MASQUERADE is o.k.
I Use following iptables construction to nat rear outgoing SMTP connections. (postfix started at physical server, and lxc containers relay mail to base system via ssmtp or nullmailer).
/sbin/iptables -t nat -A POSTROUTING -s 10.2.1.254/32 -o eth0 -j MASQUERADE
It`s universal chain, works great at number of servers, and you should not determine outgoing interface address. (as for -j SNAT –to-source X.X.X.X)
0 Comments.