Shorewall model to control NAT