&gt; except for the fact that there&#x27;s no way for a host outside your NAT to initiate contact with any host inside your NAT<p>Not true. Someone on the Internet can mark your router&#x27;s external IP as the gateway for your internal network range and send packets to your internal devices fine.<p>(In practice most NAT devices also do firewalling to prevent this, but the two functions are independent)