I've managed networks where a publicly-routable block was NATed behind their router