[bombela]

Network Address Translation (NAT) has the side effect of ignoring incoming connections that do not match an explicit port mapping.

A firewall will block any incoming connections unless explicitly allowed.

Basically the NAT happens to overlap a bit the job of the firewall as a side effect of how it works. In practice NAT and firewall are implemented by the same system. For example look at iptables on Linux.