In NAPT mode, support GRE and other non TCP, UDP protocols by falling back to 3-tuple keys. External source address, external destination address and IP protocol.

Given a large enough external IP pool, and a diverse enough set of destinations, this should scale quite well.

When fallback, the 3-tuple source address must be the same as the source address chosen for 5-tuples. I.e. a TCP connection to same destination must have same source as a GRE session to same destination. This is to ensure that stuff like PPTP works.