updated NAT logic