Firewall – How to setup a Firewall without NAT

With NAT, IP addresses in the internal network are not routable from the external one; the comparison with a firewall is not completely correct, because a firewall filters network traffic which, ordinarily, should be able to flow through it; NAT reshapes traffic that ordinarily shouldn't be able to flow that way, allowing it to flow under some specific rules.

A firewall guards a door that would be otherwise open.
A NAT opens a door where there isn't one.

With a firewall you could allow all traffic from the external network to the internal protected one; with a NAT you couldn't, even if you wished.

They're two totally different things, even if they're often confused; as far as security is concerned, a private-IP network behind a NAT is actually more secure than a public-IP network behind a firewall.

Update to respond to your example

That's exactly what I was talking about; in your case, 192.168.1.50 isn't addressable from the outside, so there's absolutely no way it can be accessed, unless you explicitely forward some external IP/port to it.

You can do this by making a smaller subnet. So for example, if you have a /24 network, you can carve out a small block from this subnet such as a /29 network.

For example if 8.8.8.0/24 was your public network. You could use a second interface with 8.8.8.240/29. You would then have 8.8.8.241 assigned to that interface and that would be the gateway for clients. You would then have 5 remaining ips you could use.

[kbrandt@alpine: ~] ipcalc 8.8.8.240/29
Address:   8.8.8.240            00001000.00001000.00001000.11110 000
Netmask:   255.255.255.248 = 29 11111111.11111111.11111111.11111 000
Wildcard:  0.0.0.7              00000000.00000000.00000000.00000 111
=>
Network:   8.8.8.240/29         00001000.00001000.00001000.11110 000
HostMin:   8.8.8.241            00001000.00001000.00001000.11110 001
HostMax:   8.8.8.246            00001000.00001000.00001000.11110 110
Broadcast: 8.8.8.247            00001000.00001000.00001000.11110 111
Hosts/Net: 6                     Class A

Even though you might have the /24 network on a different interface that overlaps with the /29, that doesn't matter because the more specific (you might think of it as smaller) route always wins. Keep in mind that when you do this you lose 2 usable ip address, one for the network and one for the broadcast.

Learning to subnet is a worthwhile skill, we have our own sort of Mega answer on that at How does IPv4 Subnetting Work?.

The other option is to not do any NAT for IP blocks and only use NAT for specific IPs. This works fine because NAT rules will take precedence as they happen before routing.