small fixes for NAT