NAT neni firewall a stoprocentne neochrani, ale routery casto maji i nejaky ten integrovany SPI firewall.