> The problem is that firewalling is difficult for the same reason that NAT is difficult. The problems you exemplify are not ipv4 or ipv6 problems, they are p

> The problem is that firewalling is difficult for the same reason that NAT is difficult. The problems you exemplify are not ipv4 or ipv6 problems, they are purely firewall problems. As you state in the article, people conflate NAT and firewall, but I fear you are too slightly mixing them in a way in your article (at least that's how it reads). NAT-PMP and UPnP are tools that do two things: - setup port forwarding for knowing where to NAT incoming packets - setup firewall not to drop incoming WAN packets on that port Incredibly enough, drop the NAT part, and the firewall part works just fine. Only for IPv6 it will be: - setup firewall not to drop incoming WAN packets on that port and for that destination which is just awesome since there will be no port conflict possible, and no port scarcity on the router. It would be downright trivial to extend NAT-PMP/UPnP IGD daemons (if that's not done already) to support that case, and I don't know the details but the protocols themselves might not even need to be modified, as the simple fact of communicating over IPv4/IPv6 might just be sufficient to gather all the required informations. EDIT: actually the NAT-PMP draft[0] makes mention of IPv6 EDIT: a quick search for UPnP IGD IPv6 leads to a presentation[1] about IGD:2, which includes IPv6 gateway firewall control. [0] http://files.dns-sd.org/draft-cheshire-nat-pmp.txt http://files.dns-sd.org/draft-cheshire-nat-pmp.txt [1] http://www.upnp.org/resources/documents/UPnPIGD2vsIGD1d10032009.pdf http://www.upnp.org/resources/documents/UPnPIGD2vsIGD1d10032...