When manufacturers venture into a product that runs software, they don't realize that for a given …

> the NAT-by-default of IPv4 IPv4 is not NAT-by-default. The reality of the world we live in today is that most home networks have a NAT, because you need multiple devices behind a single IP. That said, I completely agree. It's quite unknowable how many services I've turned on on local machines with the expectation that a router firewall sat between me and potential clients. But that doesn't go away with IPv6 - the NAT does, the router doesn't, and the firewall shouldn't either.

IPv6 is just as secure as IPv4. NAT usually combines address translation with a stateful firewall. I remember when they were separate things. IPv6 has the stateful firewall, all the same security but without the mess of address translation. Also, if you have devices connected to WAN, then they are insecure because they are not NATed.

> I know that IPv6 can be made secure, but I don't have the background or research time to learn how to do so, and the NAT-by-default of IPv4 effectively means that I get the benefit of a default-deny security strategy that makes it impossible to accidentally directly connect anything to the internet. To get the "unsolicted traffic is rejected or dropped" behavior of the typical IPv4 NAT, forward inbound traffic that's related to an established connection and drop or reject the rest. You can also use the exact same NAT techniques you use for IPv4 addresses with IPv6 addresses. The only differences are that instead of you using RFC 1918 Private Internets addresses (10./8 and friends) you use RFC 4193 ULA addresses (fd00::/8), and you need the usual NAT rules on your edge router, except for IPv6, rather than IPv4. Remember that IPv6 is still IP, just with larger addresses. It's recommended…

For some background why IoT products will stop being insecure: if you sell one in the EU, you're liable for all the damage your botnet causes. Luckily, common EU home routers have firewalls, even for IPv6. And it's so much easier to punch holes on purpose! Instead of messing with port forwarding and internal and external IP addresses, you can just say "this device is a server, please allow traffic on port 80 and 443, thank you"

NAT is not a security measure at all. It just obscures what's behind a firewall, but that is leaky and not reliable from a security perspective. It might make you feel better, but that is not security.