Masquerade behind each uplink#

You will end up with source NAT on every uplink, so traffic leaving by any of them is translated to that uplink's address. An uplink without it carries traffic that leaves with a private source address and never comes back.

Before you start#

The operator role and a licence.
At least one uplink.

Step 1 — Look at what you have#

Network → High availability → Uplinks. The Source NAT column shows, per uplink, Masquerade, the address traffic is translated to, By load balancing, or None. An uplink with None is the thing to fix, and the page's notices name it too.

Step 2 — Set it#

Click the uplink, and under Source NAT choose:

Masquerade — use whatever address the uplink has at the moment. This is what a DHCP or PPPoE uplink needs.
Translate to an address — a fixed address, for a static uplink with an address block.

Saving adds a rule with the next free number, or changes the one the uplink has. Add uplink does the same as part of adding one, masquerade by default.

Why one per uplink#

Because the rule matches on the interface traffic leaves by. A rule for one uplink does nothing for traffic leaving by another, and there is no rule that means "whichever uplink won". The symptom of a missing one is specific and confusing: everything works until a failover, and then nothing does, because traffic is now leaving by an uplink that does not translate it.

Narrowing it#

The rule the page writes translates everything leaving by the uplink. To translate only one source network, or to add exceptions, edit the rule on the NAT page, which shows the same rules with their matches and counters. Rules are evaluated in order and the first match wins, so a narrow rule needs a lower number than the broad one.

Load balancing writes its own#

Load balancing masquerades behind each uplink itself unless Keep my own source NAT is on in its settings. If you keep rules of your own, turn that on — two sets of rules eventually disagree. See Share load across two uplinks.

Check it worked#

From a client, through each uplink in turn — pin a test host to one uplink with a policy routing rule, or fail the primary — look up your public address on a what-is-my-address site. The answer should be that uplink's public address, not a timeout.

The NAT page's counters show which rule is doing the work: a rule with a flat counter after a failover is the one that did not match.

Undoing it#

Set the uplink's Source NAT to None. Stop using as uplink leaves the source NAT where it is.