take care hole punch with symmetric nat/fw