two nat boxes and a controller