Filtering packets that don't match a criteria (such as a destination port) is done by a firewall, in addition to the NAT. These are typically used together, suc

Filtering packets that don't match a criteria (such as a destination port) is done by a firewall, in addition to the NAT. These are typically used together, such as in the "full-cone" situation you described. Yes, I'm making a pedantic argument about terminology, but it's an important one because IPv6 means we can remove just the NAT part - all of the other filtering/etc features can remain. The goal is to make all devices addressable globally[1], which some people assume is a change in security. That isn't a correct assumption, as an IPv6 router (with a stateful firewall) should drop the same types of packets as their current IPv4-with-NAT router. [1] NAT badly damages the network by imposing an imprimatur[2] on the hosts behind the NAT. [2] https://www.fourmilab.ch/documents/digital-imprimatur/ https://www.fourmilab.ch/documents/digital-imprimatur/