Difference between SNAT and Masquerade I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network, should I select SNAT or Masquerade?

The `SNAT` target requires you to give it an IP address to apply to all the outgoing packets. The `MASQUERADE` target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with `SNAT`, the kernel's connection tracking keeps track of all the connections when the interface is taken down and brought back up; the same is not true for the `MASQUERADE` target.

Good documents include the HOWTOs on the Netfilter site and the `iptables` man page.