>This is what I just said, you just said it better.  Looking at a single
>flow, it _must_ traverse the same NAT device both directions or it
>doesn't work.  This is what it will do automatically by virtue of the
>specific global and inside addresses.  This provides a nice SPOF for
>the network (for this flow, as you mentioned below) removing any
>ability to converge on an alternate path. (e.g. connection reset)

yes, in both directions, but not necessarily in the same mechanism.
nat actually gets my friend more bandwidth out of his cable modem.

his cable modem uses regular old 33.6 dialup to send outbound traffic.
as a result, he gets nice input, but almost no output.  what i did for
him was set up a nat gateway on one of his machines (the one to which
the cable modem delivers inbound traffic --- he has only one address)
and set up *that* machine with a default route to his isdn provider.

the result is he gets 112k outbound instead of 33.6, and a big fat
round routing path.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
andrew@crossbar.com       * "information is power -- share the wealth."