It is correct that with IPv6, in theory, it is not necessary to use NAT (Network Address Translation) due to the abundance of addresses available, allowing each device to have a globally unique IP address.

This eliminates the need to translate private addresses to public addresses as is done in IPv4. However, removing NAT raises legitimate security and privacy concerns, as every device is potentially accessible from anywhere on the Internet.

How to implement security on a LAN with IPv6?

1. firewalls: Although NAT is not used, firewalls are essential in any IPv6 network configuration. These can be configured to allow or block traffic based on IP addresses, ports, and protocols, thus controlling access to and from your local network.
2. Access Control Lists (ACL): Use ACLs on your routers and switches to control access to network nodes, specifying what traffic is allowed to enter and leave the network based on defined security rules.
3. Network Segmentation: Divide your network into smaller subnets to limit the scope of potential attacks. This helps contain any security issues that may arise, preventing them from affecting the entire network.
4. Private IP Addresses in IPv6: Although each device can have a global address, you can also use unique local addresses (ULA) for internal communication. ULAs are equivalent to private addresses in IPv4 and are not routable on the Internet.
5. Privacy Extensions: IPv6 includes a feature called “Privacy Extensions” for Stateless Address Autoconfiguration (SLAAC) addresses, which generates random IP addresses for the network interface. This makes it difficult to track and identify individual devices on the network.
6. Security at the application and transport level: Implement security policies in applications and use encryption protocols such as TLS/SSL to protect data transmission.
7. Network Monitoring and Management: Deploy network monitoring tools to detect and respond to suspicious or malicious activity in real time.

In summary, although the IPv6 architecture can make every device on your LAN potentially accessible from the outside, implementing proper security measures and carefully configuring your firewall and other tools can help protect your network.

This ensures that the visibility of your devices on the Internet does not compromise the security of your LAN.