Firewall NAT rules process only the first packet of each connection.