Of course you can do without a NAT. But the NAT has the advantage to make the firewall rules trivial to write. Put "DROP all packets with destination 192.168.0

Of course you can do without a NAT. But the NAT has the advantage to make the firewall rules trivial to write. Put "DROP all packets with destination 192.168.0.0/16 coming from the external interface", and a few other boilerplate rules of the same kind, and poof: you just secured 99.9% of the NAT-ed networks. No configuration required. To do the same without a NAT, you need at the very least to adapt the rules to the IP addresses of the machines behind the firewall, which add complexity and increase the likelihood someone will screw up the configuration. And, hu, please don't open ports by default. That's just a recipe for disaster. If apps really want to open a globally accessible port, make them explicitly signal that to the firewall so it opens access.