masquerading and port range forwarding to internal host (with a private address)