A box that enforces that doesn't have to do NAT. In fact it's simpler and less error-prone if it doesn't.

I will be over there soon.