> No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand

> No, I'm saying the firewall is what prevents access to the router's configuration interface regardless of whether you are using NAT. I still don't understand. Even if we assume that the configuration interface has no internal security (e.g., a strong password), how would a router with a NAT but with a totally busted firewall allow access to its configuration interface from arbitrary external hosts (short of having a forwarding rule for itself, which I suspect wouldn't even work on many routers)? What would such an inbound connection from an adversary look like? > If anything port forwarding actually encourages "accidental" exposure. They are usually kept in a separate interface from the other firewall rules, which indirectly encourages configurations that do blanket exposure to the Internet. It would seem to me like host-specific IPv6 firewall rules have their own challenges. Under IPv4 NATs, special internal hosts (that need their own rules) can be trivially assigned persistent labels through DHCP. With IPv6, if each host chooses its own address and rotates it regularly, then how are hosts persistently identified in the firewall rules? By MAC address? Or are there other systems for this?