I never claimed anything about IPv6, though it would fix most of the NAT problem. Most of what you're talking about is based on how the current NAT infrastructu

I never claimed anything about IPv6, though it would fix most of the NAT problem. Most of what you're talking about is based on how the current NAT infrastructure works... which was sort of my point: NAT badly limits the scope of how we think about software, because so many designs rely on being being able to even name hosts uniquely. Designing software for the NAT "party-line" suddenly requires inventing things like remapping ports to make anything work. A particularly bad misconception that ubiquitous NAT has encouraged is the conflating of the address-translation step (NAT) with the firewall, when the two concepts are not related at all. You can run either independently of the other[1]. All that is needed for a home router is a simple firewall, and a way to open holes in the router's firewall from the internal hosts. The fact that this software isn't already available on most OS/home-routers is simple lack of demand... and the fact that it would be totally useless for current NATed home networks. You don't need all of UPNP or NAT-PMP; there are no ports that need to be mapped. The difficulty in introducing something to allow certain types of packets through a firewall is trivial compared to the complexity of working around NAT. Concerns about port scanning and "expose all open ports" are just nonsense, and has nothing to do with NAT. This all-or-nothing approach you seem to be assuming misses the entire point of having an external firewall (such as on an home router). You get to pick which packets you let through. [1] This is why NAT doesn't provide security on it's own. Static NAT, for example, is just substituting the address; all packets to the public address are forwarded to the translated address.