As a word of caution, when you get no-NAT enabled it also enables manual configuration of the inbound firewall rules (or it did last time I did this, about a year ago), with the default being ‘allow any any’ - so be ready to update this immediately after getting no-NAT enabled.