This is because most consumer routers have a firewall, which is separate from the NAT. Creating NAT mappings also creates firewall entries. Otherwise, the rout

This is because most consumer routers have a firewall, which is separate from the NAT. Creating NAT mappings also creates firewall entries. Otherwise, the router would happily pass the packet along to any IP address it finds in a packet it receives. That's the job of a router, after all.