1. A method of performing policy-based network address translation in a system for protecting a network segment, the method comprising: identifying an originating user of a first packet in a flow; identifying a network resource that is a destination of the first packet in the flow; selecting at least one predefined network address translation map based at least in part on the originating user and the network resource, wherein the map includes a plurality of user addresses corresponding to network resources; and using the selected at least one predefined network address translation map to modify addresses in at least one packet in the flow.