> But if you want to build a comparable architecture with IPv6, where a private Network is fully isolated from the public Internet except for a very controlled

> But if you want to build a comparable architecture with IPv6, where a private Network is fully isolated from the public Internet except for a very controlled gateway, you would still need a Firewall/Router capable of handling all the traffic. Nope, you wouldn't. You might still want to think abstractly in terms of a network boundary, but you absolutely do not necessarily need one point where it's all implemented. Depending on the architecture and your needs, you could also, for example, have an instance of the same packet filter on each machine. I am not saying that there is no place for that kind of architecture, but the current state of affairs with IPv4 severely limits the options as to how to implement what you actually need. In a way, even the concept of "a private network" is a bad idea. Sure, you may want to limit access to some services for some clients and such--but really, the mere distinction of "inside" vs "outside" causes many problems in today's network operations. What if you interconnect you "internal network" with some other "internal network" because someone "external" to you needs to access some service that's "internal" to you? That becomes pretty hairy pretty fast, with NAT in particular--when it's actually pretty easy conceptually when you have a globally unique address space.