the binary contains only the interface program, the nat code itself has to be in the kernel of course