Can a server on the WAN side pull data from a server on the LAN side using NAT?
Yes, NAT 1:1 lets you make LAN-side devices accessible to WAN-side devices by giving them an address on the WAN side. You can read about how to configure it here: KB-0289-00 - Connect to devices on Ewon LAN from computer on remote site
How does this affect the security? is this allowing any device access into the LAN behind the Ewon?
This reduces the security protections on the Ewon. There is no filtering of what WAN devices can access the NAT’d LAN device, but they will only be able to access the LAN devices you map in NAT 1:1. They will also be able to access the Ewon itself, so make sure you’ve changed the default password.
Just so I am clear. When you say they will only be able to access the LAN devices mapped in NAT 1:1. Is that beacuse the ewon restricts everything except the defined connections or is a matter of there is no mapping to teh LAN addresses, but the ports and protocals are still there?