It's indeed true, if in your contrived case, you have a VM doing nothing inside a NAT behind a public IP, you couldn't access it. https://tools.ietf.org/html/r

It's indeed true, if in your contrived case, you have a VM doing nothing inside a NAT behind a public IP, you couldn't access it. https://tools.ietf.org/html/rfc2663 https://tools.ietf.org/html/rfc2663 might bee a good start to see where flaws are and how it works. And it's also a great way to see how a destination machine that you're talking with can puncture through your NAT, cause you did already. And Pwnat didn't strike you as "interesting" in that it could join 2 internal networks as if they were the same collision domain, but not really?