dnat
If you are able to use snat, you may also like to use dnat. What dnat does is allow your servers (Web, mail, DNS, and so on) to live behind your snat firewall. When a new connection hits a particular IP/port combination that you've decided on, the connection is redirected to that particular server.