the NAT firewall keeps track of the packets it has forwarded, and the original source address.... when it receives a reply to a packet it changes the destination address to the orginal source address and forwards it