Comment by nikanj

What would be grandma-proof equivalent of the implicit firewall provided by ipv4 NAT?

The Right Way would be to make informed decisions per-port and per-protocol, but that's a nightmare to set up, and to maintain.