You could turn NAT off completely and still no-one on the Internet could reach your 192.168.0.7. There's no security perimeter coming from NAT here. > And the

You could turn NAT off completely and still no-one on the Internet could reach your 192.168.0.7. There's no security perimeter coming from NAT here. > And the NAT router won't send a packet that arrives with its public IP as dstIP to any machine behind it Yes, of course. The problem is when a packet arrives with the IP of a LAN machine.