dont masquerade public network, but do it with management