> It's very hard to screw up, unlike v6 firewalls which often have bad defaults or possibly don't work as intended. ??? Firewalls generally have inside and ou

> It's very hard to screw up, unlike v6 firewalls which often have bad defaults or possibly don't work as intended. ??? Firewalls generally have inside and outside: default-deny any new connections from the outside and you're done. This is how all CPE gears ships out of the box. > Especially when one of the other goals of ipv6 is to enable p2p applications, which might lead to permissive defaults. For this you need hole punching, with on CPE gear is done with UPnP and/or PCP, the exact same protocols that are used with IPv4 NAT. (But of course applications also have to futz around with TURN/ICE/STUN if there's NAT.) > No matter how crappy my router is, it's impossible to address private IPs from the outside except on the random mapped ports. When I was still with a residential ISP that did IPv6 this was the exact same with all of my home devices behind my ten+ year old Asus. Further, because you only have one public IPv4 address, someone can scan just that address to see which ports are forwarded. People regularly scan the entire IPv4 address space: 2^32 addresses is not a difficult task. With IPv6, they'd have to know the IPv6 address of your service that you had opened to the public. If you hadn't advertised the address publicly, an Internet rando is not going to find it: good luck remotely scanning a single /64 (never mind a /60 or /56 that many ISPs hand out).