To use the IP masquerade facility, your kernel must be compiled with network packet filtering support. You must select the following options when configuring the kernel:
Networking options ---> [M] Network packet filtering (replaces ipchains)
The netfilter package includes modules that help perform masquerading functions. For example, to provide connection tracking of FTP sessions, you'd load and use the ip_conntrack_ftp and ip_nat_ftp.o modules. This connection tracking support is required for masquerading to work correctly with protocols that involve multiple connections for one logical session, since masquerading relies on connection tracking.