OK. Thank you. By redoing it all again to make some screenshots, I actually found what I was missing. "CONFIG_NF_CONNTRACK" is disabled by default on arm. Enabling it made NF_NAT available. My main mistake was, that I thought all possible options are always in the .config file just commented out if not active. This is obviously not the case. Thank you all.