It’s not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it’s not really different to NAT port forwarding rules.
The argument for IPv6 that there could be a unique address for 200 devices for every person living on the planet was much more compelling when network security was a more simple space.
Because devices in your LAN will all be accessible from the internet with IPv6, you need to firewall every device.
It becomes more of a problem for IoT devices which you can’t really control. If you can, disable ipv6 for those.
It’s not necessary to firewall every device. Just like how your router can handle NAT, it should be able to handle stateful firewall too.
Mine blocks all incoming connections by default. I can add (IP, port range) entries to the whitelist if I need to host a service, it’s not really different to NAT port forwarding rules.
The argument for IPv6 that there could be a unique address for 200 devices for every person living on the planet was much more compelling when network security was a more simple space.
Nothing has changed about why that is compelling: NAT sucks and creates nothing but problems.
Network security is almost the same with IPv6.
If you rely on NAT as a security measure you are just very bad at networking.