The effect of EIM + EIF is that if a private port reaches out to somewhere on the Internet, then anywhere on the Internet can reach back to that port. So a por

The effect of EIM + EIF is that if a private port reaches out to somewhere on the Internet, then anywhere on the Internet can reach back to that port. So a port scan can find it. Off the shelf consumer NAT "routers" tend to have an "allow out by default" policy. Now given the garbage one tends to find in the software of lot of off the shelf devices, the only way to ensure they don't "reach out to the Internet" is with an explicit outbound firewall, which prevents them reaching out. A web browser these days opens so may connections, and is so vulnerable, that one should view those sitting behind a consumer NAT is not behind a firewall. FWIW - My day job includes implementing and maintaining (i.e. writing the software) for commercial NAT and firewall devices.