I'm trying to understand the peer discovery process, especially for a private network with majority of the nodes having dynamic IP addresses and behind typical wifi router firewall. If I run a Geth node with --nodiscovery flag, the node will only call out/connect to other peers, not accept calls from peers, correct? Isn't my firewall already doing that? And those peers my node calls out to must have port 30303 open, and they must be in discovery mode, correct? If my node is in NOdiscovery mode, I need a bootnode list or manually add (via file or CLI) static nodes in a private network, correct? Basically, if a new private network was created, some of the nodes would have to be in discovery mode and/or have port 30303 open on the WAN side, or the network would fail, correct? And does a private network have to supply a bootnode list everytime I restart Geth?
The --nodiscover option works the other way. If you run geth with this option, the geth node will not search for any peer and not connect to any peer. So yes, you will need a bootnode list or add peers manually if you use the --nodiscover option. However, you need it for your node, not for the others.
As far as I know, you cannot hold back other nodes from connecting to your node, besides changing or blocking the port used for peer discovery. The default for that port is 30303, that's right, you can change it with the --port option.
To answer your question: --nodiscover is not redundant behind a firewall without port forwarding, since it achieves a different goal.