I would not describe having two different routing domains as a firewall.  It&#x27;s not a fence set up by a firewall that only lets correct packets through.  It&#x27;s a gaping chasm that only the NAT process crosses; packets are transformed as they cross and only some packets are possible to transform.