nat: TCP state tracking based on RFC 7857/RFC 6146