am "Separate NAT from forwarding."

merged from goog/mirror-m-wireless-internal-release
35e36db Separate NAT from forwarding.