make sure nat stuff happens in order