Masquerade Should be Attached To Routes, Not Addresses

Unless you use noprefixroute when adding an IP address to an interface, the kernel naturally creates a route for that IP's subnet. Neato.

It seems that systemd takes advantage of this fact, by then inferring the masquerading subnet.

In other words, if you set IPMasquerade=yes, then ip addr add 192.168.77.43/24 dev eth0 will result in iptables -t nat -A POSTROUTING -s 192.168.77.0/24 -j MASQUERADE. This works because noprefixroute is not in use.

But the actual thing that's going on here is that there's a masquerade entry being made related to the route added to the interface, not the address. However, systemd's logic is erroneously hooked up to the address.

Thus this configuration:

[Match]
Name=whatever
[Network]
IPMasquerade=yes
Address=192.168.77.43/24

will result in iptables -t nat -A POSTROUTING -s 192.168.77.0/24 -j MASQUERADE. However, this configuration:

[Match]
Name=whatever
[Network]
IPMasquerade=yes
[Route]
Destination=192.168.77.0/24

will not result in any added masquerading entry. This is incorrect behavior.

The proper behavior would be to add a masquerade entry related to each of the routed subnets, not just the implicit routes attached to addresses.

This is particularly important when using layer 3 tunneling (such as via WireGuard or IPIP), where a common configuration is to not actually assign any specific IP address to the tunnel interface, yet still have it route packets.

Start by tracing how IPMasquerade=yes handles the [Route] Destination setting and how it currently derives masquerading from Address entries. Compare the generated iptables POSTROUTING rules for implicit address routes and explicit routed subnets; done means each routed subnet receives the appropriate masquerade entry, including routes on interfaces without assigned addresses.