> If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever

> If you misconfigured it so that it was exposed and people could now break in, then all they would need to do after that is set up port forwarding to whatever internal host they want. Why are these objections always "What if I configure my IPv6 network in worst way possible?" Your router's configuration interface should be hosted on either a ULA or a link-local address, neither of which are routable. Security isn't the only reason you want to do that. If you host the config interface on a globally-routable address, that address will change every time your ISP delegates your network a new prefix (which happens about as often as you would get a new external IPv4 address via DHCP). A router is the one of the few things on your network you should be able to access even without working DNS, so why do you want the config interface to be on an address than can change unexpectedly? ULA and link-local addresses can be static: The network prefix will be static. In IPv4, this is like asking "But what if I host my router's interface on the public assigned-by-DHCP IP?" My response would be "Why the hell would you host the config interface on an address that can change at any time?"