[411111111111111]

Its just basically impossible to get a consumer grade nat without an inbuilt stateful firewall.

He's correct that the NAT doesn't stop the connection, but the stateful firewall is another service on the same device so you will never really notice the difference

With the theoretical situation of a NAT without a firewall a connection is technically possible, as long as you are able to inspect any previously sent TCP packets and use the sender bits to route your new packets