I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal

I think the real question is "what the hell IoT is doing on a globally-routable network?" Put it on an isolated VLAN with no Internet connectivity. Or a minimal connectivity only to what's absolutely necessary (e.g. I haven't seen IoT devices that need inbound connections, so drop any inbound packets unless conntrack says otherwise). There there will be probably no need for weird NAT66 contraptions or anything like that - just old good plain drop-by-default firewall. But then, the article is about consumer tech, and most consumers aren't gonna set up any VLANs, firewalls or complex NAT systems, they don't know anything about those. They got one single flat WiFi network and that's about it. So, I guess, all the technical suggestions here are not really relevant.