[Spivak]

Your appliance 'router' can (and probably does) run a firewall to give you that kind of control. NAT never really gave you that.