How NAT sends inbound traffic to a LAN device and which security trade-offs that creates.
Verify an exposed service
Suppose a router forwards public TCP port 8443 to an internal server. Confirm the service is listening locally, then test the public address from a different network. Under CGNAT, a home router's forwarding rule may never receive inbound traffic. Remove the rule after testing if persistent access is unnecessary.
Check it with Net Utils
Use the relevant Net Utils tool and compare the structured output with your expected configuration. Public network data changes, so confirm important conclusions with a repeat test.