Masquerading (IP masquerade, MASQ) lets the computers of a private network reach other networks — usually the Internet — behind the address of an Artica interface: the outgoing traffic appears to come from Artica, and the replies are sent back to the right computer.
Use it when Artica is the gateway of a network and the next router does not know the route back to that network.
¶ Three ways to masquerade an interface
| Where | Effect |
|---|---|
| Masquerade page (this page) | Masquerades the traffic leaving the interface; optionally restricted by rules (see below). |
| Masquerading option of the interface (parameters page) | Masquerades all the traffic leaving the interface. The Masquerade page then shows every outgoing packets, defined in the interface option. |
| Masquerading option of an interface connector | Masquerades all the traffic leaving the destination interface of the connector. |
¶ Enable masquerading on an interface
Go to Your Firewall › Masquerade. The page lists the interfaces of the appliance:
- Check Enabled on the interface through which the traffic leaves (for example the Internet interface).
- The Rules column then shows every outgoing packets: all new connections leaving the interface are masqueraded.
The interface must be linked to the firewall; otherwise the column shows that the firewall is disabled on it.
¶ Masquerade only some networks
A masquerade entry can be restricted with firewall rules. The entry appears as an interface named MASQ:<id> in the Network Interface list of a firewall rule.
- Create a rule on the
MASQ:<id>interface. - Restrict it with Inbound object (source networks), Outbound object (destinations) and services.
- Action Accept: the matching traffic is masqueraded. Any other action makes an exception: the matching traffic leaves without being masqueraded.
As soon as an entry has at least one enabled rule, only the traffic described by its rules is masqueraded, in the order of the rules: the Rules column lists them. Remove or disable all the rules to masquerade every outgoing packet again.
When the interface option or a connector already masquerades the interface, everything is masqueraded whatever the rules of the Masquerade page.
¶ Masquerading or source NAT?
- Masquerading uses the current address of the interface; it follows the address if it changes (DHCP, PPPoE).
- Source NAT uses a fixed address that you choose; see Network address translation.