People keep saying "the sky is falling, with ip6 all the hosts are open to the internet" but not really it is usually one rule. on openbsd pf block outside co

People keep saying "the sky is falling, with ip6 all the hosts are open to the internet" but not really it is usually one rule. on openbsd pf block outside connections from initiating connections to your hosts block in on $external_if from any to $ip6_network on ip4, if the world was just you would have the same rule(in ip4). however the world is not just and you usually only get one address so you have to pull some shenanigans to spoof that address across all your hosts match out on $external_if from $internal_net to any nat-to $external_if Really we all have a sort of Stockholm syndrome and think yes, this is normal, this is correct and being able to end to end address a host is weird and wrong.