tweaked the acl parser for NAT