A stateful firewall isn't a fundamental requirement for NAT though, even modern NAT ("or actually PAT", as other posters seem to like saying...). State tracking

A stateful firewall isn't a fundamental requirement for NAT though, even modern NAT ("or actually PAT", as other posters seem to like saying...). State tracking is certainly a requirement, but tracking state is separate from firewalling based on that state. This is why firewalling is separate from NAT, and why NAT isn't a firewall. Yes, it's true that both NATing and firewalling rely on tracking state, and typically both NAT and firewalling are implemented together in the same software and hardware, but they're two separate behaviors and you can do one without doing the other.