> True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also w

> True, but it also doesn't route them anywhere unless you've explicitly configured it to OR there was outbound traffic on that 5-tuple recently, so it's also wrong. No, what you are describing is a stateful firewall. Also, neither a NAT nor a firewall route anything, that's what a router is for. > The NAT functionality drops the errant packet on the floor just as much as a traditional firewall. NAT does not drop anything. NAT translates. Hence, "network address translation". And it's not an errant packet. It's simply a packet addressed to an address reachable on one of the interfaces attached to the router, and not matching any NAT rules that would initiate translation of a connection nor any existing tracking state of a previously seen connection where return packets need to be translated. Packets that don't fit in either of those categories are simply left untouched by a NAT. And the router the NAT is running on will then just forward them as any IP router would do. That is, unless there is a stateful firewall present as well. In which case you still don't need the NAT to use it.