a terrible NAT kludge