Abstract: A method for network communication includes receiving from a first network a data packet having a header specifying a first source address in the first network and a destination address in a second network and looking up the first source address in a network address translation (NAT) table. Upon finding, in response to looking up the first source address, that the first source address is not listed in the NAT table, an entry is added to the NAT table specifying a corresponding second source address in the second network. One or more additional first source addresses that are not listed in the NAT table are predictively selected, and one or more further entries are added to the NAT table specifying one or more second source addresses in the public network corresponding to the one or more additional first source addresses.