If the source IP or destination IP address is an RFC 1918 compliant address, the packet cannot be transmitted over the public Internet, and these addresses cannot transit a Network Address Translation (NAT) or Port Address Translation (PAT) device without invalidating the HMAC of the crypto packet.