"NAT Device" = "Firewall" (in this context) = "What you'd normally have with a public address plus the translation part". There tends to be conflation that som

"NAT Device" = "Firewall" (in this context) = "What you'd normally have with a public address plus the translation part". There tends to be conflation that somehow you need an additional device to filter you've not had in place before. In order to do NAT a device has to be at the edge of your network (your device or the ISPs) which tracks connection states to automatically translate outbound ones and allow the reverse mappings through while that is open. Getting rid of NAT simply means dropping the "translate" part from that device. The conntrack and allow outbound initiated connection part remains. Instead of port forwards for inbounds you just have inbound allows. There is no big swap of security roles between devices or special additional configuration needed, just the independent removal of the translation configuration from the device.