They have a simple kernel module, which seems to do just about nothing so the rest of NAT must be happening in userland.

People wishing to discuss how they did the messy bits are invited to join this thread.