On modern firewalls/routers, NAT is only one cooks in the network kitchen raining on this author's parade. Stateful Packet Inspection has timeouts too!
I had an elastix box for a while and after watching a few vulnerabilities go unpatched and getting hacked twice I gave up on Elastix... http://www.elastix.org/en/component/kunena/116-security/6078.... Switched to PBX in a Flash and while its more secure, the user interface is clunky and requires you to use a number of custom closed-source scripts to keep everything up to date...
If my assumption of dropbox's intent is correct, I prefer facebook's approach to this problem. Instead of wording terms exclusively in their favor they could have extended an olive branch...
"For content that is covered by intellectual property rights, like photos and videos ("IP content"), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook ("IP License"). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it."
facebook's license to share the picture of your cat terminates after you delete it from your profile. Had dropbox used similar strategy while drafting their terms, this would not be news...
(Disclaimer: I am not a lawyer and do not pretend to be one on TV.)
Diomede might be worth a look. Their offline and nearline options are waaay less expensive than S3. Never used them though so let us know how it works out if you go with them.