Routers gonna route.
Firewall is the one that would block that by saying "Sorry, but I shouldn't ever see packets destined for 10.10.10.0/24 on my eth0 interface".
Also, every competently designed router has a rule that blocks that address range on the external interface.
The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.
It's not necessarily the whole internet. If someone wants to compromise you, they only need to gain access to a router at your ISP. Also, ISPs do misconfigure stuff and allow direct layer 2 communication from neighbours, or accept routing protocol advertisements from customer-facing ports. Whether you like it or not, those things just happen, and a well-secured network has a firewall that makes sure it is completely inconsequential to you, so, no, you actually don't have "bigger issues", you have an absolute non-issue.
> Also, every competently designed router has a rule that blocks that address range on the external interface.
So, like those with hard-coded default passwords and shell injection vulnerabilities in the web admin interface? Is that the kind of competently designed router that you are talking about?
Noone claims that a properly configured firewall isn't part of a "competently designed router". The question is how many of the routers out there are competently designed. If anything, this idea of "NAT implies a firewall" is one reason why border gateways end up "incompetently designed", because it doesn't, but if you believe that when designing such a device (be it for mass production or as an individual manual configuration), chances are you'll end up with a completely unprotected network.
> The whole NAT isn't a firewall meme is pendantry at its finest since NAT is implemented as part of the firewall.
That is like saying that saying "Word isn't Excel" is pedantry because Word is implemented as part of Excel. It's just nonsense. Both share some common technical foundation, and even code for common functionality. That doesn't make one "implemented as part of the other".
It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
Which is just completely irrelevant to the question of whether the device has a firewall, see my inactive air bag analogy in my reply elsewhere in this thread.
> It's like saying the chart builder in Excel isn't part of Excel because it's not the spreadsheet editor.
Except that you are arguing for the idea that a chart builder necessarily implies a spreadsheet program and that therefore you need a chart builder, because otherwise you can't have a spreadsheet problem.