IPv6 : fin du mythe "le NAT en IPv6 çà sert à rien"

That said, there is no reason that NAT couldn’t be used in the exact same way it is being used in IPv4. In fact, a router could be designed to have one IPv6 address on the WAN port with an IPv4 private network behind it that NAT’s onto it(for example). This would be a simple solution for consumer and residential people. Another option is to put all devices with public IPv6 IP’s— the intermediate device then could act as a L2 device, but provide a state table, packet inspection, and fully functioning firewall. Essentially, no NAT, but still blocking any unsolicited inbound frames. The important thing to remember is that you shouldn’t plug your PC’s directly into your WAN connection with no intermediary device. Unless of course you want to rely on the Windows firewall… and that’s a different discussion. Every network, even home networks, need an edge device protecting the local network, in addition to using the Windows firewall.

• Source : http://serverfault.com/questions/184524/switch-to-ipv6-and-get-rid-of-nat-are-you-kidding

Pour ma part, j’utilise du NAT66 avec PF sous BSD, ce qui correspond au mappage d’une IPv6 publique sur une IPv6 privée. Ceci pour deux raisons :

• indépendance : le changement d’une adresse IP publique ou privée doit d’être possible et rapide.
• centralisation : le filtrage du trafic externe s’effectue toujours sur le point d’entrée d’un réseau et non pas après coup sur les hôtes.