Because the 192.168.2.x network is

Because the 192.168.2.x network is an unrouteable network, external communications are handled by the NAT server, which maps internal (192.168.2.0) addresses to external (10.10.10.0) addresses. This prevents an attacker from compromising one of the internal boxes and accessing the internal network with it. The exception is the proxy server (rule 7 in Table 6-19 on the internal router’s inbound interface), which should be very carefully configured. If the organization does not need the proxy server, as in cases where all externally accessible services are provided from machines in the DMZ, then rule 7 is not needed. Note that there are no ping and Telnet rules in Tables 6-18 or 6-19. This is because the external firewall filters these external requests out. The last rule, rule 8, provides cleanup and may not be needed, depending on the firewall.