(top-posted to match the original OP)

Unless you are explicitly configuring more-public addresses on your IPv6 connections, your upstream gateway machine, router or switch should be providing link-local addresses to anything local.  All switches are required not to forward link-local addresses upstream, giving you the NAT-like isolation that you desire.

--

John Mellor


On 2020-12-29 8:53 a.m., Neal Becker wrote:

Let me say up front I'm not very knowledgeable about  v6 yet.  One reason I don't want to enable it is the exact flip side of the address scarcity of v4.  Because of that, external connections are nat'd.  That seems to me to offer an additional layer of protection for devices on my network, they don't have externally routeable addresses.  I think that is not true if I turn on v6.  Is this correct?

On Tue, Dec 29, 2020 at 6:24 AM John Mellor <john.mellor@gmail.com> wrote:
On 2020-12-28 7:51 p.m., Jorge Fábregas wrote:
> Is there a known application/service that might *misbehave* because it
> expects a an ipv6 stack these days?

The Fedora IP stack used to stall for several seconds in several
previous releases.  The normal workaround for that was to disable IPv6,
causing pretty massive speedups.  That problem went away at about Fedora
32 or 31.

IPv4 has an address-space capacity issue, and is effectively dead.  The
allocated IPv4 address space remains tight in North America, and
completely exhausted in most other parts of the world.  In my case,
while my internal network remains IPv4 since I use older switches, while
my upstream is IPv6.  The only machine that has to be IPv6 internally is
my HP printer.  My ISP does not have anywhere near enough IPv4 addresses
to support its large customer base, so they were forced to upgrade most
of their network to IPv6.  Their v4-to-v6 translation and vice-versa
works pretty transparently.  I haven't noticed any issues for a couple
of years now.

One interesting and nice side-effect of IPv6 is that I get a lot less
drive-by shooting trying to attack my network.  I used to get about 3
port-scanning attempts/day, and now I go weeks without an
intrusion-detection hit.  I don't think the bad guys have figured out
how to attack IPv6 addresses yet.