add needs_nat policy