i don't think the typical NAT setup differs too much from a typical filtering setup. That is, only allow return traffic from public interfaces. While that is ki

i don't think the typical NAT setup differs too much from a typical filtering setup. That is, only allow return traffic from public interfaces. While that is kinda implicit using NAT the change to being explicit is trivial. somewhat simplified like this using iptables on linux: iptables -t nat -A POSTROUTING -o WAN -j MASQUERADE vs iptables -A FORWARD -i WAN -m state ! --state RELATED,ESTABLISHED -j REJECT