@finlaydag33k i really don't have any of those problems 🤷‍♀️

@bonifartius Then either you are not aware of them but still have them, your vendor added special sauce, or your telling bs.

@finlaydag33k devices running services get a fixed ip, the rest is autoconfiguration. the gateway is opnsense, maybe that makes a difference. the bespoke linux gateway i used before didn't give me any v6 troubles too.
if anything v6 made my life easier, i don't have to use dyndns or stuff like that anymore for services at home 💁

@bonifartius >devices running services get a fixed IP.
Unless you mean setting the IP at the side of the host or disabling the privacy extensions, that is probably a big difference already, cus that, is not how it should be done per spec.

Also, OPNsense may help a lot too because it tends to do a *lot* for you, I use MikroTik (which means I have to do a lot myself but get insane capabilities back for it).

DynDNS never was an issue for me either way since I just have a small script on my router

@finlaydag33k @bonifartius no, the bouncing IPs are due to privacy extensions. Standard SLAAC is deterministic. You shouldn't firewall local traffic by local IP on any case. Use inbound/outbound interfaces, ports, etc.

@ulexus Well, that's basically what I said "unless you mean (...) or disabling the privacy extensions".

I don't firewall by IP either, just, like you said, interfaces and ports (mostly ports since interfaces are shared a lot of the time between multiple "mixed" devices).

@finlaydag33k got it... But in that case, what's actually the gripe? ;)

@ulexus having to keep a *lot* more track of what goes where, a *lot* more testing (to make sure I didn't make a security oopsie) and a lot more firewall rules.

@finlaydag33k why is it a lot more firewall rules, though? Just use nftables and get both v4 and v6 at once. And NAT didn't give you local firewall either; it's just an incidental cheat that provides no direct inbound requests from outside the router performing the NAT. Even then, you're externalizing your security to the router and assuming all local traffic is good... Otherwise, you locally firewall anyway.

@ulexus I can't use nftables (since I use MikroTik).

I don't care much about the local traffic either way.
All that was on it, is my own traffic, so if that was to be compromised, I had far bigger issues to worry about.

@finlaydag33k i like Mikrotik hardware, but that software has always irritated me. Anyway, i can't argue anything about that, i guess.

@ulexus The software is kind of a pain at times yea.
I got used to it after a while but when I need to do a big change, it is a massive pain.
I do with they would just revamp the way it is managed... especially when it comes to managing the WiFi...
then again, MikroTik WiFi is kind of a joke imo...
WiFi7 is already knocking on the door and they only just now announced that WiFi6 devices would be "coming soon"...

@finlaydag33k i made the same devil's bargain with Ubiquiti years ago, with their EdgeRouter line. I'm almost fully off of it now.

@ulexus The main thing for me is that Ubi makes lazy imo.
You basically buy into their ecosystem and get so used to it that you kind of just stick to them (a solid business strategy ofc).
With MT, I can still mix and match and a lot of things I learn from using their gear can fairly easily be translated to other manufacturers as well (just need to figure out the specific ways of doing it).

though I mainly want a "fire and forget" solution without breaking the bank, which MT provided just fine.

@finlaydag33k I'm talking about their EdgeMAX series, not their UniFi. It's basically a customized vyatta interface running debian. Flexible and customizable, with none of that UniFi fully-automatic stuff.
Kind of like Ubuntu: UniFi is a great system... for everyone else.

@ulexus Oh right, I kinda of (wrongly) assumed you also had their UniFi stuff.
I never worked with the EdgeMAX series beyond it.

I checked their line-up quickly but they don't have equivalents of the stuff I use (lots of 10Gbit stuff) in the price points I am willing to pay :\

@finlaydag33k I'm pretty disappointed with them overall, these days. They haven't meaningfully added features in many years; they're running really old kernels and debian; they're much less price competitive than they used to be; and their UniFi WiFi stuff, which is where all the development effort seems to be doesn't really interoperate.
I need to find a new hardware platform for routers, but there's no way I'm jumping into RouterOS.

@ulexus I mean, honestly... If you don't share the same requirements I have, I steer people away from MT quite a bit.
The software really takes some time to get used to and even then is a big pain.
Imo, if MT would up their game in software, they'd be really good.