nuintari's rules of networking 0x13:

Seriously.

NAT is not a firewall.
NAT is not kind of a firewall.
NAT is not like a firewall.
NAT is not sort of a firewall.
NAT is not a firewall.

There is a world of difference between explicitly denied traffic, and traffic dropped because the device just didn't know what to do with it.