https://bugzilla.redhat.com/show_bug.cgi?id=1033606
--- Comment #41 from Marek Goldmann mgoldman@redhat.com --- (In reply to Lokesh Mandvekar from comment #35)
I could add
ExecStartPost=firewall-cmd --add-masquerade ... to the unit file, unless there's a cleaner solution
Please don't do this. This should be already covered in my patch.