The moment you send a packet outside of your network, anybody who can see that packet along the path that it is traversing to the destination and the one at the destination knows that that IP address is 'live' in one way or another. Easiest way to thus find hosts is to just look at an access.log of a webserver and presto (then again, if you can have a host contact your webserver most likely there are other more nasty things that you can do already as you can feed it javascript and/or fool the user into doing something they didn't want to do at your host) The "Firewall" in your NAT is because of STATE. Indeed, if you want to protect a network/address from being able to communicate to anything and you think that firewalling is the only appropriate way, then do so. But remember that if you have STATE in your firewall, that any outbound connection will punch a hole right through that firewall rules you so preciously set up; unless you do the ordering correctly, but most very likely you'll run into issues where the blocked port is being used in a connection that you wanted to create state for, though you don't know why in the first place.... As you took the excellent example of mail, the firewall is really not your worry, as someone with evil intent will just send you a proper email and it will nicely arrive at that host. Remember: Firewalls are not the final answer in security. Best thing you can do: don't have any services running that you don't want running, verify this once in a while and the other extreme route: don't connect it to the internet in any form.