> There actually is a deny If you don't have NAT: - the packet with your IP in dst_ip would be thrown out If you do have NAT: - the packet with your IP in d

> There actually is a deny If you don't have NAT: - the packet with your IP in dst_ip would be thrown out If you do have NAT: - the packet with your IP in dst_ip would be thrown out In both cases the decision to drop the packet were carried out by the firewall and not NAT. So puh-lease, stop.