NAT is actually less restrictive for inbound connections, because it allows people to connect with just the correct port and not the correct IP+port. Instead of

NAT is actually less restrictive for inbound connections, because it allows people to connect with just the correct port and not the correct IP+port. Instead of needing to provide the correct 80-bit number to connect, they only need the correct 16-bit number, which is small enough to brute-force. NAT doesn't even stop machines opening ports; it's your firewall doing that. It's not NAT giving you a single point of presence, that's your router. It doesn't normally restrict outbound connections either, so what's the point? All it's doing is presenting your servers in a way that makes them easier to find. NAT doesn't do any of the things you've claimed to need it for.