I'm not sure these attacks have anything to do with NAT - all of the stuff under "DHCP methods to control routes" sounds like it would work just the same if the

I'm not sure these attacks have anything to do with NAT - all of the stuff under "DHCP methods to control routes" sounds like it would work just the same if the router was handing out public IPs to the internal network. Or even if the internal network is statically-assigned for that matter. The only requirement seems to be a DHCP client on the WAN interface that's overly permissive in what it accepts.