State table keys

one state entry per connection, stored in two trees
10.1.1.1:20000 -> 62.65.145.30:50001 -> 129.128.5.191:80
outgoing packets: 10.1.1.1:20000 -> 129.128.5.191:80, replace source address/port with gateway's
incoming packets: 129.128.5.191:80 -> 62.65.145.30:50001, replace destination address/port with local host's
three address/port pairs for one connection: lan, gwy, ext
without translation, two pairs are equal
translations stored in state entries (no separate map)