NAT is complex
- requires router to do lots of packet processing
Both IP and tcp header fields need adjustments
- change to check sum, sequence number, acknowledgement are required
+ NAT may need to change the data stream (pocket payload) too e.g. in FTP
+ external client cannot initiate communication with internal server