added -ip-masq flag to optionally disable IP masquerading