> I'm not really seeing a reason why it would be impossible to open firewalls in that scenario.

Cheap ass ISP-managed routers. Got to be lucky for these rubbish bins to even somewhat reliably provide IPv6 connectivity to clients at all, or you run into bullshit like new /64's being assigned every 24 hours, or they may provide IPv6 but not provide any firewall control...

▲

themafia 2 hours ago | parent [-]

> or you run into bullshit like new /64's being assigned every 24 hours

It'd be nice if DNS servers supported this. Save the 64 host bits in the zone and just use whatever 64 prefix bits happen to be issued right now.

Otherwise it makes a strong case for the continued use of "private networks" and the IPv6 ULA mechanism.

▲

lxgr 2 hours ago | parent [-]

> Otherwise it makes a strong case for the continued use of "private networks" and the IPv6 ULA mechanism.

Let's please not. Even without inbound reachability, hole punching is significantly easier given globally routeable addresses.

▲

themafia 2 hours ago | parent [-]

You can have /both/ a ULA and a Globally Routable address. In practice it works just fine. My internal DNS points to the ULA for internal connectivity and my hosts use their global addresses for external connectivity.

▲

lxgr an hour ago | parent [-]

Ah, you mean for cases where you want both stable addresses (even if only internal) and globally reachable ones (even if non-constant)?

Yeah, that works, but everything gets much easier if your internal DNS can just support the varying prefix natively, e.g. via integration with the external-facing DHCP or PPPoE or whatever other address configuration protocol you use, since then you can reach everything both locally and globally by name.

	▲	themafia an hour ago \| parent [-]
		> but everything gets much easier It also gets more fragile. If your ISP can't or doesn't issue you a prefix for whatever reason then your entire IPv6 network stops working even internally. This is even more pertinent if, like me, you're on a 4G LTE connection. Verizon has great IPv6 support, when you can get it, and when you can't I'd still prefer to have a stable internal network.