When you mentioned servers, you reminded me of something neglected from your initial writeup that's a bit important to understand: for many years, people have r

When you mentioned servers, you reminded me of something neglected from your initial writeup that's a bit important to understand: for many years, people have ran with NAT as a de-facto firewall for incoming connections to their devices. With IPv6, since the hosts are now on a routable public network, they need to have proper firewalling enabled. (It's as simple as accept related/established, deny invalid, accept icmp.)