> NPT would enable you to route your ULA addressed gear to the internets if they don't have a globally routable address.

One convenient thing about ULA+NPTv6 is that, unlike IPv4 NAT, is that an external IPv6 address is basically 1:1 'equivalent' to an internal IPv6 address. The NPTv6 is stateless so that, firewall rules allowing, a connection can come right in without all sorts of contortions for port mapping.

Most (residential) gateways by default block incoming requests unless they're a reply to a previous outgoing connection. I know I can ping6 the iMac I'm typing this on, but attempts to (e.g.) SSH in are blocked by default.

To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful.

When you do a IPv4 "pinhole" port map you get precisely one mapping and it will timeout eventually, which can lead to all sorts of exciting debugging opportunities.

IPv4 does have 1:1 NAT but there are so few IPs so whilst I have a /24, 2 x /28 and 2 x /29 to play with and others, I doubt most do.

NPTv6 maps an entire address space from A->B and is actually not designed to deal with NATv4 anyway. It is for outbound connections.

> To spell that out a bit more - a ULA to NPT address is IP based and not port based and is way more useful.

This is implementation specific: on my Asus I can specify to allow in all ports from in via a NPTv6-ULA hole, a port range, or even a single port.

If I want to only allow tcp/25 in to a particular IP I can do that, if I want 5900-5910 I can do that too, as well as 1-65535.

Well it sounds like your ASUS needs a damn good kicking!

A router moves packets from A->B and a firewall defines what is allowed from A->B.

ULA to NPT is router stuff: NPT literally means "Network Prefix Translation" it turns all your IPv6 addresses into a normalised one and shifts them.

We are not talking about ports or protocols yet, just (IP) addresses.

> Well it sounds like your ASUS needs a damn good kicking!

Why? This is exactly how I want it to work: pass through only the ports (or all the ports) I want/need for the service in question.

It might be that your ASUS is combining two things into one UI for convenience. Mapping one IPv6 prefix on the WAN to another on the LAN is one thing. Allowing traffic to a particular IP:port to cross from WAN to LAN is another. They're independent, though of course both are needed for the overall high-level task of "allow my LAN server to be reachable to the internet", so it makes sense to have a UI that does both things under the hood.

You don't really need NPT. I'm on XFinity as well and I just have GUA from them and then my own set of ULA addresses.

If Xfinity changes the /60 they're giving me it doesn't change anything internally - because my internal names all use the ULA - and the GUA just gets used to get to the Internet.