Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's ob

Exactly. Rip out all of that logic that maintains the address translation table and performs address mangling and you have a simple stateful firewall that's obviously less complex. It's difficult to see how ripping out the address translation could be more exploitable or costly to maintain. Ideally, we'd start with things written from the beginning to be stateful firewalls, but if I worked for a home/small office router ventor, my first course of action would be to just ripp out that potentially buggy address translation part of our existing NAT implementation.