It won't link unless conntrack is in the kernel, and *that* is costly for
some.

What we could do is make NAT support optional in Kconfig and have that
option depend on conntrack.  Would need a little fettling of cake itself to
make the NAT support properly optional at compile time.

- Jonathan Morton