For the umpteenth time, NAT is not a replacement for a firewall.
http://security.stackexchange.com/questions/8772/how-importa...
http://security.stackexchange.com/questions/8772/how-importa...
How ISP level firewalls should be configured is an interesting and open question for consumer level connections. For mobile connections default deny seems like an OK place to start, given that mobile connections tend to be shared and metered. I hope that this doesn't stifle the innovation that could come from true peer to peer mobile connectivity though.