NAT on home routers typically allow all outbound connections initiated by the user from the LAN. NAT is typically paired with UPnP to allow users/hosts/services to open required ports outbound as required.
Typically, there is no restriction on initiating outbound connections to make the connection as user-friendly as possible.
If you consider the following factors common to home router deployments:
- lack of monitoring
- poor or default configuration (default passwords)
- users (even technical users will click on
- poor security of hosts on the LAN (A/V, patching)
An attack which exploits the way NAT works on home routers, rather than a direct attack on NAT itself, is simply a (spear)phishing attack against a user on the LAN.
Example: A packed PDF which the user is likely to click on, and subsequently executes code to call home, will be able to initiate a connection outbound allowing the attacker to utilise the reverse channel to further exploit the LAN host, as required.
Note: This comes from my experience with home routers (Billion, Linksys) running default firmware. If a home user deploys a Cisco 877 or Linksys running custom firmware, additional security controls could be applied.