Why use NAT with unsafe_routes?

[IanVS]

This is copied from an email sent by Achim Patzner:

I have a slight problem with the contents of https://www.defined.net/nebula/unsafe_routes/ -- simply put: "why use NAT if you do not want to to reach nodes whose default router is not under your control/part of your network". In the example you're providing the default router of LAN (in case it is not the linux host in that diagram) needs to get a single additional route (add -net 192.168.88.0/24 via 192.168.88.10) and that's it -- linux host already has the correct routing table entries. The only reason for adding NAT is something you don't mention: Packets leaving that subnet and getting routed onto a network where it is not possible to add a route to your nebula network (call it "the Internet"). But that means that router should do the NAT or you might get another useles NAT into your path.

[brad-defined]

There are alternative ways of configuring the network to route the packets appropriately, as you suggest, if you wish to do it another way. The NAT/MASQUERADE technique is one that works fine, and the how-to article wanted to ensure that response traffic is routed appropriately.