> a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. Everyone on your corporate n

> a) Mask end-user addresses somehow. You wouldn't want everyone on your corporate network to get a globally unique, trackable ID. Everyone on your corporate network has tons of globally unique, trackable IDs. They're called cookies. Also, there are IPv6 privacy extensions. > b) Allow outgoing connections in arbitrary ways but forbid random incoming connections. Just as with IPv4? > c) Some sort of central, highly secured network node where your admins can configure this stuff. That's called a firewall. You need one with IPv4 as well. > At this point you're close to reinventing NAT, except crappier. None of that has anything to do with NAT.