added nat rules, still incomplete though