> if a device on the WAN side sends to your router a packet with destination address on the LAN side This can happen only if the device is directly attached to

> if a device on the WAN side sends to your router a packet with destination address on the LAN side This can happen only if the device is directly attached to the NAT server. Basically, only your ISP can do that. Most NAT servers by default also prohibit this kind of routing (because why even allow it?!?), but even the most misconfigured bad NAT server is still vulnerable only if you control the ISP, in practice.