<p>The <a href="https://kubernetes.io/docs/admin/kube-proxy/" rel="nofollow noreferrer">kube-proxy admin page</a> says:</p>

<pre><code>--masquerade-all       If using the pure iptables proxy, SNAT everything
</code></pre>

<p>But it does explain in detail.</p>

<ul>
<li>When should I set <code>--masquerade-all</code> to true? </li>
<li>And what problem it solves? </li>
<li>What could happen if it set <code>--masquerade-all=false</code>? What is the difference compared to <code>--masqurade-all=true</code>?</li>
</ul>

<p>If you enable this and route the service IP range to your nodes then it will be possible to reach the service IPs from outside of the cluster.</p>

<p>The discussion is in <a href="https://github.com/kubernetes/kubernetes/issues/24224" rel="noreferrer">Issue #24224</a> and it's implemented in <a href="https://github.com/kubernetes/kubernetes/pull/24429" rel="noreferrer">PR 24429</a>.</p>
