If it was just a Linux box, they'd probably be much better off. It's all the crap that vendors add that usually causes problems. Most people building their own

If it was just a Linux box, they'd probably be much better off. It's all the crap that vendors add that usually causes problems. Most people building their own iptables firewall would not enable any ALGs, since they're almost always the worst way to solve NAT problems. OTOH, vendors want everything to work out of the box as much as possible, even in weird edge cases with broken servers/clients, so they enable all available ALGs and sometimes don't even provide a way to turn them off.