[PATCH] don't try to do any NAT on untracked connections