NAT inside the host, not the guest