[screamingninja]

It's worth noting that NAT is not a security feature in itself, but rather a way of conserving public IP addresses and hiding the internal network structure. The best way is to use a stateful firewall that is built into nearly every router.

Another option is to use IPv6 Unique Local Addresses (ULA), which are similar to private IPv4 addresses and can only be used within a specific site. This approach enables internal connectivity for devices that do not require direct access to the Internet. I use it for several IoT devices that I do not want reaching out to the mothership.