modern firewalls do however match on tuple in their session table.

Sure, the protocol is connectionless, that doesn't mean a firewall can't reason about which side the traffic is originating from in its session table.

Or that joke about TCP:

1: Do you want to hear a joke about TCP?

2: Yes I do want to hear it.

1: I confirm you want to hear it.

1: I am now going to tell the joke.

2: I acknowledge you are now going to tell the joke.

1: I will now start the first sentence of the joke.

2: I acknowledge I am now ready to hear the first sentence of the joke.

1: So a network packet walks into a bar

2: Sorry I couldn't quite here you. Please start over.

1: Do you want to hear a joke about TCP?

Ehm, no? Your router still do kind-of connection tracking while NATting UDP requests to, say, outside DNS servers, otherwise UDP would not work at all in a NATted environment. There might be stupid or very stupid home routers but I'd expect the port forwarding rules to be applied only if an incoming UDP packet doesn't match any NAT connection tracking tuple in the router.

> (UDP doesn’t do sessions, remember.)

Operating systems do. You can associate remote & local port-ip tuples with UDP just as much as you can with TCP.

So, you are sure this is a mind-bogglingly stupid advice, but in fact you don't know ?