NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more

NAT doesn't do this on its own. It would be a duplicate implementation of the stateful firewall, so NAT leaves this piece to the firewall. NAT is nothing more than a lookup table of router IP+Port and internal IP+Port pairs. (Well, PAT style NAT anyway... But that's what everyone here is talking about...)