And that's how we can't transfer large files from one computer to another, and why audio and video calls over the internet are only done through well founded companies, so there's nearly no competition.
The reason is I haven't configured my firewall to let any of those things through. IPv6 or IPv4 NAT is in the same boat.
But if your computer had connectivity to the rest of the network, you could choose to disable protection on some port, and help bootstrap some software like those. Instead, with NAT, you can't.
My point is that even if I could today, with either IPv4 or IPv6, I don't really _want_ that.
It would make my internal network dependent on the external network, and the benefits don't outweigh that major downside.
It sounds like what you really want is a firewall, not NAT. Having a globally unique prefix (either IPv6 or v4) does not mean your network is completely accessible externally. There are no dependencies. It actually makes things simpler if you ever want to connect two internal networks.
My point is that if you have a firewall you're in the exact same position as if you have a firewall+NAT in that you need to be able to punch holes in it.
IPv6 on its own does nothing to help with this.
With NAT the internal nodes can for the most part work like normal. They might experience a gap of a few seconds where communication with the external network (the Internet) is down, but apart from that nothing.
You might say just use ULA[1]! To which I will say what's the point of IPv6 then?
This is kind of like the railway administrators who say "there's no reason to have the train stop in TinyTown, there are no passengers waiting for it there".
If I could receive incoming connections, I could host my own Internet services (such as my own web site) AT HOME, and not be at the mercy of corporations to allow me to offer my information and/or services.
Because that's the big advantage with IPv6 and users getting subnets instead of a single IP.
Why not accept that and roll with it?
Once I get Genode or GNU Hurd running, I'll gladly hook it straight to the the full IP4/IP6 public addressed internet. Until that day, nope.
The firewall rule that allows packets from ESTABLISHED and RELATED connections back to a host behind a NAT is the exact same rule that allows packets to get through a default-drop firewall.
You should put them behind NAT if you want to connect your network to the internet but you don't have enough IP space to do it. It has nothing to do with how secure you think your OSs are.
I don't believe any firewall out there is fit for purpose, because the OS on which it is based is likely to be insecure. On top of that OS would then be the firewall software itself.
I would truly love to be proved wrong, but mathematically proven systems are few and far between.
NAT is just as horrible, and secure, as spanning tree.
I specifically didn't.
I said that nobody sane connects to the internet without a firewall. That firewall will of course be default-drop because otherwise why bother.
With that firewall in place, nodes on the outside of the firewall cannot talk to nodes on the inside without some configuration. So the fact that the nodes share an address space is moot.
My point was that punching a hole in that firewall requires a similar effort or solution that adding a NAT rule does.
Moreover, the router is a lot simpler as it doesn't need to keep track of connections, which works well with TCP, but not necessarily with UDP. So, you can actually use other protocols other than TCP easily too. The only downside of IPv6 is that it is not backwards compatible, but being able to identify devices uniquely has no down sides.
That's not entirely true. It's possible to assign source port/address combos that route to different hosts.
For example, I can say that:
* 1.1.1.1:80 routes to 192.168.1.2:80,
* 8.8.8.0/24:80 routes to 192.168.1.3:80, and
* everything else on port 80 routes to 192.168.1.4:8080
It's possible to get even more convoluted, though not recommended.
(If I read your post as written, it also seems to say that the client needs to pick a custom source port and if they're using NAT then they also need to get that source port unaltered through all of their layers of NAT. And they'll be limited to one connection at a time, perhaps one connection for however many people are behind the same CGNAT, because only one connection can use a specific source port at a time.)
So yes, you can pile hacks on top of hacks on v4, but it's not similar effort to just permitting the connection in a firewall, and it has a bunch of extra limitations too.
What does work though is ULA (Unique Local Addresses) - they're also designed to prevent conflicts when you eventually end up making a mashup of your and someone else's network who also wanted to use their own addresses.
NAT is great because it acts as an abstraction layer for the external network, in that the nodes on the local network can talk to each other and be blissfully ignorant of the details of the external network.
And for the majority of local networks there's a fundamental asymmetry between the local and external network. The majority of nodes on local networks only ever need to connect _out_ to the external network, they don't need incoming connections.
Going to 128bit addresses essentially makes DNS required. And when using DNS nobody really cares about the address of the host. They just want to be able to talk to the host on the other end, whatever it is.
Being fully peer-to-peer is a pipe dream. Nobody wants their entire local network exposed to the entire internet without a firewall. And with a firewall comes the exact same hole-punching problem that NAT has.
So that's the problem they should have tried to solve better, I think. They should have embraced NAT and the inherent network asymmetry, and found ways to make it better rather than trying to abolish it. Embraced that DNS needs to play a more central role than it does today, because nobody really cares about addresses.