NAT shouldn't be used as a replacement for a firewall. So the answer was always to set up a firewall.