A subnet uses NAT Gateway. A partner tries to initiate a new inbound connection to one of its NAT public IPs. What should the network engineer explain?

1. NAT Gateway is for outbound connectivity and return traffic, not arbitrary new inbound connections
2. Increasing the idle timeout creates an inbound listener
3. Adding a private DNS link makes inbound NAT possible
4. NAT automatically forwards inbound packets to every VM