Which command adds a NAT rule using MASQUERADE for traffic leaving through WAN?

Which command adds a NAT rule using MASQUERADE for traffic leaving through WAN?

• A. /ip firewall nat add chain=srcnat out-interface=wan action=masquerade
• B. /ip firewall nat add chain=srcnat in-interface=wan action=masquerade
• C. /ip firewall nat add chain=dstnat out-interface=wan action=masquerade
• D. /ip firewall nat add chain=srcnat out-interface=LAN action=masquerade

Answer: (A)

Masquerade is used for outbound traffic to the Internet, translating internal source addresses to the router’s WAN IP so return traffic can come back properly. To apply this to traffic leaving the network, you must use the srcnat chain and specify the interface through which traffic exits. The rule should target traffic that goes out through the WAN, with the masquerade action to perform the dynamic SNAT. Therefore, the command that fits is one that adds a NAT rule with chain=srcnat, out-interface=wan, and action=masquerade. The other options mix up the direction or the type of NAT: using in-interface=wan NATs inbound traffic from the Internet, dstnat is for port forwarding inbound to internal hosts, and out-interface=LAN targets traffic leaving toward the LAN, not toward the Internet.

Masquerade is used for outbound traffic to the Internet, translating internal source addresses to the router’s WAN IP so return traffic can come back properly. To apply this to traffic leaving the network, you must use the srcnat chain and specify the interface through which traffic exits. The rule should target traffic that goes out through the WAN, with the masquerade action to perform the dynamic SNAT.

Therefore, the command that fits is one that adds a NAT rule with chain=srcnat, out-interface=wan, and action=masquerade. The other options mix up the direction or the type of NAT: using in-interface=wan NATs inbound traffic from the Internet, dstnat is for port forwarding inbound to internal hosts, and out-interface=LAN targets traffic leaving toward the LAN, not toward the Internet.