IPv6 be like...
Ideal: IPv4 LAN addresses, DHCP and NAT have too much management overhead! If we use 128-bit addressing with a 64-bit prefix per network, management will be zeroconf and greatly simplified!
Reality: Not every network is on the Internet, some don't have any GUA, but they still need to work when routed. Other networks are switched, they don't use routers at all, like a LAN party.
Ideal: Easy. Let's define three kinds of addresses: a link-local address is an address reachable only from the same Ethernet hub or switch, a ULA address is an address reachable from a routed LAN, and a GUA address reachable from the Internet. Every machine will have three addresses!
Reality: But it gives each machine three addresses.
Ideal: It's not a problem, because everything is still zeroconf. Look! The link-local addressing is especially elegant, you plug machines to a switch and your LAN party games just work by default like IPX! You can also number all routers in every LAN as fe80::1!
Reality: But hardcoding IP addresses from the MAC allows user tracking, the same traveling laptop can be tracked across Russia, America, and Australia!
Ideal: If you worry about privacy, you can generate additional temporary addresses to cycle them, in addition to your sensitive EUI-64 address.
Reality: Not all ISPs hand out a 64-bit prefix per consumer, it may be managed in a pool externally. The same problem occurs when you run second-layer routers inside your 64-bit prefix, the prefix is no longer free!
Ideal: Let's add DHCP Prefix Delegation to the protocol. A router uses DHCP to ask for a smaller prefix it controls from the router above, this allows nested routing with global addresses, you can just cascade routers without creating double or triple NAT!
Reality: Exposing the whole network to the Internet is insecure, an accidental misconfig allows a worm to SSH in with password 123456!
Ideal: Global-routing doesn't mean "open all ports". Don't forget a firewall on the router works for the entire network. You can still open and close ports in your firewall config.
Reality: Now, a machine has 6 addresses, a link-local address, a ULA address, a GUA address, a DHCPv6 /128 address, a DHCPv6 delegated prefix for other machines below, and a privacy-extension address for outgoing traffic. When you add a server, select the address carefully via routing metric, and don't forget to "open" ports on your router's firewall - but at least you're not "forwarding" ports now.
