[kortilla]

The destination IP header from the internet belongs to the router. There is nothing internal to connect to without NAT.

[Dagger2]

No, it might belong to the router. If it does then the connection goes to the router, but if it's set to a LAN machine's IP then the packet gets routed to the LAN machine.

You aren't in control of the contents of inbound packets, and NAT won't filter them to enforce anything about the destination IPs in them either.