That's (IMO) pretty terrible default behavior.

1) Is it easy for a somewhat technical person to change? 2) If you don't mind telling, who's your ISP?

There's an IETF standard that says IPv6 home routers should have a default deny firewall. http://tools.ietf.org/html/rfc6092#page-15 Some people are trying to get it changed: http://tools.ietf.org/html/draft-v6ops-vyncke-balanced-ipv6-...

Both of those are Informational documents, not Standards. :) Documents like this one are Standards: http://tools.ietf.org/html/rfc2616

Given the quality of MSFT's and Apple's firewalls, and the ease of use of MSFT's (I assume Apple's is easy to use, but I have no direct experience), I cannot agree that a default DENY firewall policy is a good default configuration. We'd be back in the world where consumers would need something uPnP to manage firewall rules on their router.

I can agree that refusing to route requests to things like port 445/tcp is reasonable.

It's definitely not ideal (blocking end-to-end routing defeats a lot of the point of IPv6) but i understand the security POV. It is straightforward to change, about the same complexity as forwarding a port was on IPv4 (click around in web ui for a minute or two).

The router is an AVM FritzBox 7340, the ISP is Snap (New Zealand).

I have no idea if this setting is common or not for IPv6 deployments.

Thank you very much for the information. I, too understand why that would be the default configuration. It's very good to hear that it's not a pain to change.

Do you know if you can set that FritzBox up to just act as a DSL->Ethernet bridge and pass through packets to another device that does all the routing? (Sorry if that doesn't make sense. I'm not a professional network nerd, so my terminology might be confused.)