"NAT is absolutely not a firewall."

That is what I said, hence the puzzlement at your response.