The actual difference between Nat-3 and Nat-2 is source port translation taking place (i.e. »
docs-legacy.fortinet.com ··· at2.html). Using DMZ mode will work around it by allowing others to connect directly to you, but if your router let's you change source port translation for select IPs, you won't need to go that far.