Masquerading Made Simple HOWTO.

Masquerading must be put in the NAT chain or the router won’t know how to return packets to subnets other than its own LAN.