That's not much harder, that's exactly what happened to them in the initial attack. You're still depending on either a "secret" IPv6 network, or your upstream

That's not much harder, that's exactly what happened to them in the initial attack. You're still depending on either a "secret" IPv6 network, or your upstream provider performing some source-based routing to only route packets from the VPN connection. I doubt that's available to a simple colo customer.