[ownagefool]

You'd want the firewall configured with default deny, but there's no need to keep the NAT.