table ip filter { chain postrouting { type nat hook postrouting priority srcnat; policy accept; oif veth0 masquerade } }