[josephcsible]

This is exactly what firewalls are for. Your "layer" of defense is the defense. If you want another layer, then set up another firewall further along the network.

[ggm]

This. NAT is not a firewall, never was. incidental benefit, which can't be relied on, specifically when there's no NAT (most v6)