>>107059262
Have you ever heard of this thing called a firewall? You know, the thing that comes by default with practically every router and device in existence? You are aware that NAT isn’t the only way to stop people reaching random devices in your network?
A default deny incoming firewall will serve the same function as a NAT, with the advantage of not needing reverse proxies or scuffed port-forwarding shit (I don’t even know if this is doable with CGNAT at all, I’ve never had to deal with it).
This is even assuming that an attacker can find your internal IP addresses. Scanning a /56 prefix that an ISP should give out requires checking 4,722,366,482,869,645,213,696 addresses, and even the shittier /64s some retarded ISPs give out have 18,446,744,073,709,551,616 to check. Given that most devices will periodically shift their IPv6 address, an attacker will have had to
1. Be connected to by the device they’re targeting
2. Stage an attack before it changes its IP
3. Hope you don’t have even the most basic firewall that prevents random incoming connections to devices behind it
This “I need NAT to secure my network, because I’m too crippled with AIDs to turn on a firewall and add a default drop rule” is pushed all over the place. IPv6 has more issues in shitty hardware support than this. Hell, if you are that retarded, just run IPv6 NAT.
