[yonz]

Exactly! Duplicating my point in a thread below to drive your point home:

NAT was an added layer on top of firewall rules because inbound ports had to be mapped to a particular host and port since the router would not know which host to send to. This created a default opt out experience because for a port on your machine to get accessed, a packet must pass inbound rules and match a port map table entry.

[throw0101c]

NAT was created for one reason only: because there weren't enough IPv4 addresses to go around.

Port mapping and connection tracking firewalls were invented in 1989,[1][2] while network translation was created in 1994. [3][4] The private address space was only reserved in 1996.[5] The Firewalls book was published in 1994 (which meant that it was being written in the 1992-3 timeframe).[6]

People were protecting networks before NAT.

[1] https://en.wikipedia.org/wiki/Firewall_(computing)#Connectio...

[2] https://en.wikipedia.org/wiki/Circuit-level_gateway

[3] https://www.rfc-editor.org/rfc/rfc1631

[4] https://en.wikipedia.org/wiki/Cisco_PIX

[5] https://www.rfc-editor.org/rfc/rfc1918

[6] https://en.wikipedia.org/wiki/Firewalls_and_Internet_Securit...