nat: limit resource consumption when out of ports