Because of NAT ALGs, most consumer NAT devices actually allow plaintext protocols to bypass the internet-facing firewalls inside routers. Unless you program yo

Because of NAT ALGs, most consumer NAT devices actually allow plaintext protocols to bypass the internet-facing firewalls inside routers. Unless you program your own ALGs, you basically get to pick between "SIP, FTP, and a bunch of other protocols don't work without port forwards" or "your public firewall is off for almost anyone who can make your computer load an ad". NAT breaks internet protocols and as a result we got firewall-evading workarounds.