You want to set up an 'egress only' v6 gateway for your /64s (or however you carve up your netblock). That is going to be the closest analogue to behind-a-NAT-like behavior.

Thanks I'll look into it with pfSense.

Your router has a firewall, external computers can't just send packets to the internal addresses. NAT is not a firewall.

So IPv6 firewall rules are common now for consumer routers?

Yes.

My mum's boring broadband connection, with a free router supplied by the ISP in the UK, has the functionality next to the port forwarding settings for IPv4.

That's typical. Look up IPv6 pinhole to see how ISPs document it.

OK, so I suspect that it varies greatly among markets.

But I wonder, is it a fair assumption that the router that you get will either 1) not route IPv6 at all, or 2) route IPv6, and by default deny incoming traffic? Problematic would be ones that routed IPv6, and by default accepted incoming traffic.

First, nothing is common for consumer IPv6 routers, they're practically non-existent.

Second, you get the same security benefits by having a firewall that denies outbound connections not already established.

I bought an IPv6 router 3-4 years ago.

Most people don't buy routers, they are given them by their ISPs. My parents switched ISP at the start of the year and were given a 5 year old modem/router.

You're also on Hacker News. They have been available for a long time, but they're firmly a techie/early adopter product.

In many countries the ISP supplies the router. I've had IPv6 capable routers for years and years in Britain, but it's only in the last 2 years or so that the IPv6 address has been assigned by the ISP.

I think whilst it's nice to have that barrier, it's prevention rather than cure anyway. There's no substitute for secure devices :)

what's more secure than a device you cannot possibly reach?

I'll take an insecure device isolated at the bottom of the ocean in a titanium block over a probably-secure device that is publicly addressable any day.

Your appliance 'router' can (and probably does) run a firewall to give you that kind of control. NAT never really gave you that.

Which devices are secure?

Certainly not the 'router' running your NAT.

Yep.

Be sure that you are really isolated if relying on it for protection. Its only as secure as the least secure node inside the bubble, and there can be quite a dangerous in large networks like in a company or campus. It would not surprise me if a number of WannaCry victims was behind nat and got infected by a machine on the same local network.

I was at a company that made a mistake like this during their IPv6 rollout. The firewalls are different an individual, and initially they only had iptables rules on their BGR and an empty ip6tables set.

This is the case for ipv6 on mobile data by default. Would using a usb modem result in getting affected by smb exploits or something of the sort?