No NAT, just use nginx to proxy web traffic.