I ran across this old post by Dave Presotto when someone inquired about Plan 9 as a firewall:

If you have multiple Plan 9 machines, you can use one as an inside/outside

machine and just import it's outside interface onto the inside
machines.  For example, this is how we configure our outside interface.

        # second ethernet to serve the outside IP
        echo starting ether 1 to the outside
        bind -b '#l1' /net.alt
        bind -b '#I1' /net.alt
        ip/ipconfig -x /net.alt -g 204.178.31.1 ether /net.alt/ether1 204.178.31.2 255.255.255.0
        ndb/cs -x /net.alt -f /lib/ndb/external
        ndb/dns -sx /net.alt -f /lib/ndb/external
        aux/listen -d /rc/bin/service.alt -t /rc/bin/service.alt.auth /net.alt/tcp
        aux/listen -d /rc/bin/service.alt /net.alt/il

Then you can import that interface to inside machines.

        import achille /net.alt /net.alt

This has the advantage of letting you announce nothing on the outside so that
you don't have to worry about attacks.  You can do anything you want on the
inside and packets can't get out.
**************

If one is running a mail server and has it inside their firewall and if using one IP then t has to use NAT. Couldn't one presumeably use the setup above and run a mail server on Plan 9 and bypass having to use NAT?  And also do the same thing for a web server?