1. A method for performing policy-based network address translation in a system for protecting a network segment, the method comprising: a) identifying, by a network device deployed between an internal and external network, a first user from a first packet, the first packet having a first source internet protocol address of the external network and a first external internet protocol address of a network resource within the internal network; b) identifying, by the network device, a second user from a second packet, the second packet having a second source internet protocol address of the external network and a second external internet protocol address of the network resource within the internal network; c) identifying, by the network device, from plurality of user based network address translation maps a first network address translation map assigned to the first user and a second network address translation map assigned to the second user; d) determining, by the network device, from the first network address translation map, an internal internet protocol address of the network resource based on the identified first external internet protocol address assigned to the first user and, from the second network address translation map, the internal internet protocol address of the network resource based on the identified second external internet protocol address assigned to the second user.