> Yes, rules do work exactly the same, but with IPv4, you just let all the connections out through, and let just the established and connected ones back. The s

> Yes, rules do work exactly the same, but with IPv4, you just let all the connections out through, and let just the established and connected ones back. The same is typically true of IPv6 for default configurations. You aren’t required to allow IPv6 hosts to accept unsolicited incoming traffic. > But it is... you need a bunch of new rules to pass through, limit or block a bunch of ICMPv6 messages.. there's a whole RFC just for that - https://datatracker.ietf.org/doc/html/rfc4890 https://datatracker.ietf.org/doc/html/rfc4890 With the exception of home agent, mobility and other IPv6-specific messages, many of these recommendations also hold true for IPv4. It’s just that nobody really bothers to think that deeply about it, block all ICMP and then are shocked_pikachu_face when Path MTU discovery etc don’t work.