You're right that in a technical sense, NAT isn't block connections, more like it allows connections in the first place that would otherwise not be possible. Bu

You're right that in a technical sense, NAT isn't block connections, more like it allows connections in the first place that would otherwise not be possible. But that's the best part. It's very hard for a misconfigured NAT to result in devices being exposed, unlike a true firewall, which is actively blocking connections to devices that would otherwise be totally reachable. NAT is sucky in plenty of server-side situations and is thus avoided, but in homes and offices, yeah I wouldn't want it any other way.