[OpenWrt-Users] Why SNAT does not work when 'option masq 0' is set in /etc/config/firewall?

[Damian Kaczkowski]

Hello all.

I need your help guys. Could someone with bigger experience with OpenWrt
please explain me why SNAT does not work when *option masq is set to 0*? I
lost a whole day to find out that SNAT only works when *option masq is set
to 1* (in /etc/config/firewall). Why is that? *"**iptables -t nat -A
zone_wan_nat -j MASQUERADE**"* is redundant if one want to use SNAT
instead. So why SNAT doesn't work without it? What really does *option masq
'1' *besides setting *"**iptables -t nat -A zone_wan_nat -j MASQUERADE**"*?


For example:
iptables -t nat -I POSTROUTING -s 10.10.0.0/16 -j SNAT --to-source x.x.x.x
or
iptables -t nat -I zone_wan_nat -j SNAT --to-source x.x.x.x

does not work when:

config zone
option name 'wan'
option network 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
* option masq '0'*
option mtu_fix '1'

?

But do works when we set *option masq to 1. *I don't know if this is a bug,
or proper behavior. What do you say?

btw. Thanks in advance for any explanation.

**
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openwrt.org/pipermail/openwrt-users/attachments/20120713/f2b5991c/attachment.html>

[Damian Kaczkowski]

Post by Damian Kaczkowski
I need your help guys. Could someone with bigger experience with OpenWrt
please explain me why SNAT does not work when *option masq is set to 0*?
I lost a whole day to find out that SNAT only works when *option masq is
set to 1* (in /etc/config/firewall). Why is that? *"**iptables -t nat -A
zone_wan_nat -j MASQUERADE**"* is redundant if one want to use SNAT
instead. So why SNAT doesn't work without it? What really does *option
masq '1' *besides setting *"**iptables -t nat -A zone_wan_nat -j
MASQUERADE**"*?

To answer my own question. *'option conntrack*' depends on *'option masq*'.
If *'option masq == 0'* then *'option conntrack == 0'*. But conntrack must
be enabled for SNAT so forcing *option conntrack 1* for wan zone solves the
problem...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openwrt.org/pipermail/openwrt-users/attachments/20120714/e902220e/attachment.html>