change SNAT to MASQUERADE, which is easier to code