the packet via end.dx4 cannot seems to be masqueraded by '-t nat' rule of iptabes ip masquerade. Is it a behavior you expect?