If you're going to do SOHO routing safely/correctly, you'll need to do some sort of connection tracking. You'll need to allow packets on new and existing outbou

If you're going to do SOHO routing safely/correctly, you'll need to do some sort of connection tracking. You'll need to allow packets on new and existing outbound connections, but only allow incoming packets on existing connections. SOHO routers generally won't support this in hardware, so you have to route on the CPU anyway. NAT on IPv4 vs stateful routing on IPv6 is a wash in terms of performance.