access inside systems from outside

[s m]

hello every body

i am newbie in pf and nat and have a conceptual problem with it. i
enable inside nat and it works properly (inside addresses are nated to
external ones). i can ping outside systems from inside but not in
reverse side.

my question is: is it the true behavior? i mean when we have inside
nat, just inside systems should access outside systems and outside one
should not access to inside ones? in cisco we can access inside
systems from outside when inside nat is configured.

please help me to clear my mind and understand what is correct manner.
thanks in advance
sam