> Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in th

> Why won't it? Seriously, it looks like the default state for me: If you have an external, globally visible IP address and a port is open on it, everyone in the world can try and connect to it. Well... yeah, if you open a port then the port is open. Since every firewall I've seen - including the ones in cheap garbage home routers - defaults to deny all inbound / allow all outbound, that's not the "default state", that's something you have to specifically add. (And again, same applies to NAT; you can add a port-forward rule, but if you care about security maybe don't.) > With NAT, there's no obvious way to connect from the outside to the inside, because the inside cannot be addressed from the outside. I am precisely concerned with the non-obvious ways. If we're talking about a server environment where every single device on the private subnet is trusted and doesn't get compromised, no ports are forwarded, there is no DMZ, and UPnP is absent or disabled, then it might work, but I would still trust it less than a firewall. In a home or office environment those constraints go out the window (UPnP was quite popular once, IoT ensures there's an endless supply of untrusted devices, and, y'know, Cross-Site Scripting attacks making every device with a browser a potential threat), which is probably why I have the cached heuristic of "don't trust NAT for security".