Comment by p_ing

> its not about the firewall. there's just a lot of extra attack vectors without a nat.

Not if your firewall is dropping packets. It doesn't matter if your internal network has routable public IPs or not.

Apple used to have all (most?) workstations on publicly routable IPs since they jumped on the A class networks early.