State table keys one state entry per connection, stored in two trees 10.1.1.1:20000 -> 62.65.145.30:50001 -> 129.128.5.191:80 outgoing packets: 10.1.1.1:20000 -> 129.128.5.191:80, replace source address/port with gateway's incoming packets: 129.128.5.191:80 -> 62.65.145.30:50001, replace destination address/port with local host's three address/port pairs for one connection: lan, gwy, ext without translation, two pairs are equal