This. At least, if you're not ready to accept incoming v6 connections (which really isn't hard to do), use connection tracking to let outbound v6 through and add the necessary icmpv6 accept rules.

ufw comes pre-installed on ubuntu and is dead simple to use, there's really no reason not to use it.

  # ufw allow 22/tcp
  # ufw enable

should be all you need to have connection tracking on both v6 and v4, have a tried and trusted icmpv6 accept list, and keep your v6 and v4 firewalls in sync.

I like to use a limit rule (ufw limit 22/tcp) for SSH, to discourage brute force attacks. If nothing else, it will help reduce the noise in the log files.

This isn't a replacement for basic precautions such as disabling root login and not allowing password authentication, of course.

I prefer to not limit SSH but use fail2ban instead to remove the noise.

That. I was relived when I saw he advising against disabling ICMP, just to read that at the next paragraph.

It's past time ops security realize their job is to make the system run securely, not to stop it so nobody gets in.

It's even 2016 now.