Ok thanks for the detailed explanation, so much to learn in this field.
You mentioned if someone would send package from outside the network intended for the Guest the NAT wont know it is intended for the Guest.
If I have have devices in the network that initiate connection with the virtual machine, can I somehow forward this to the virtual machine?
I see under NAT settings I can add ports to a Guest static(?) Ip address, is this something I can use to enable this? Let say we have a html5 based application on a device in the network, it sends a package request to the Guest IP address with https so I add port 8433 in NAT network settings to a guest Ip-address. Would this work?