5.10. Configuring IP Address Masquerading

IP masquerading is a process where one computer acts as an IP gateway for a network. For masquerading, the gateway dynamically looks up the IP of the outgoing interface all the time and replaces the source address in the packets with this address.

You use masquerading if the IP of the outgoing interface can change. A typical use case for masquerading is if a router replaces the private IP addresses, which are not routed on the internet, with the public dynamic IP address of the outgoing interface on the router.

To check if IP masquerading is enabled (for example, for the external zone), enter the following command as root:

~]# firewall-cmd --zone=external --query-masquerade

The command prints yes with exit status 0 if enabled. It prints no with exit status 1 otherwise. If zone is omitted, the default zone will be used.

To enable IP masquerading, enter the following command as root:

~]# firewall-cmd --zone=external --add-masquerade

To make this setting persistent, repeat the command adding the --permanent option.

To disable IP masquerading, enter the following command as root:

~]# firewall-cmd --zone=external --remove-masquerade

To make this setting persistent, repeat the command adding the --permanent option.