firehol-masquerade(5)

💅 firehol-masquerade — bestie's guide to NAT-ing on an interface

okay so this is firehol-masquerade(5) from the FireHOL Reference, version 3.1.8, and it's literally the page that teaches you how to set up masquerading (NAT) on an interface. sit down, grab a snack 🍓, we're doing networking.

---

✨ SYNOPSIS ✨

masquerade real-interface rule-params

masquerade [reverse] rule-params

that's it. that's the whole vibe. two forms, no cap. 💖

---

🦋 DESCRIPTION 🦋

the masquerade helper command sets up masquerading on the output of a real network interface — as opposed to a FireHOL interface definition. yes bestie, that distinction matters, i promise.

if a real-interface is specified, the command should be used before any interface or router definitions. multiple values can be given separated by whitespace, so long as they are enclosed in quotes. 👑

if used within an interface definition, the definition's real-interface will be used.

if used within a router definition, the definition's outface(s) will be used, if specified. and if the reverse option is given, then the definition's inface(s) will be used, if specified. 🔄

not me about to drop the most important plot twist: unlike most commands, masquerade does not inherit its parent definition's rule-params. it only honours its own. the inface and outface parameters should not be used — iptables(8) does not support inface in the POSTROUTING chain, and outface will be overwritten by FireHOL using the rules above. so like… don't. 🙈

Note 📌 the masquerade always applies to the output of the chosen network interfaces. FIREHOL_NAT will be turned on automatically (see firehol-defaults.conf(5)) and FireHOL will enable packet-forwarding in the kernel.

---

🌈 MASQUERADING AND SNAT 🌈

masquerading is a special form of Source NAT (SNAT) that changes the source of requests when they go out, and replaces their original source when they come in. the way that it just… does that. 😭✨

this way a Linux host can become an Internet router for a LAN of clients having unroutable IP addresses. masquerading takes care to re-map IP addresses and ports as required.

now the part nobody wants to hear: masquerading is expensive compared to SNAT because it checks the IP address of the outgoing interface every time for every packet. 💀 if your host has a static IP address you should generally prefer SNAT.

---

🎀 EXAMPLES 🎀

# Before any interface or router
masquerade eth0 src 192.0.2.0/24 dst not 192.0.2.0/24

# In an interface definition to masquerade the output of its real-interface
masquerade

# In a router definition to masquerade the output of its outface
masquerade

# In a router definition to masquerade the output of its inface
masquerade reverse

iconic. ate. no notes. 🔥

---

👑 SEE ALSO 👑

• firehol(1) — FireHOL program
• firehol.conf(5) — FireHOL configuration
• firehol-interface(5) — interface definition
• firehol-router(5) — router definition
• firehol-params(5) — optional rule parameters
• firehol-nat(5) — nat, snat, dnat, redirect config helpers
• FireHOL Website
• FireHOL Online PDF Manual
• FireHOL Online Documentation

---

💜 AUTHORS 💜

FireHOL Team. (periodt, they did that 🫶)

---

FireHOL Reference ✦ version 3.1.8 ✦ built 13 Apr 2025 — that's the whole firehol-masquerade(5) moment, bestie. go forth and NAT responsibly, mwah 💅💖🌸