With IPv4, you used to be able to give a host a static local IP address on the LAN, and use a firewall rule on the firewall/router to forward a port on the (possibly dynamic) Internet-facing IP used by the network to a port on tat particular host, using the host's static LAN IPv4 address as a stable way to identify the host in the firewall rule.
But with IPv6, every host is using real routable Internet IPs, so the incoming traffic for the host will already be addressed to it, and there's no need for NAT. But you still need to be able to write a firewall rule to say that inbound traffic to one particular host and port should be allowed, while traffic to other hosts or ports is blocked.
But if the prefix under which the network assigns IPv6 addresses is dynamic, how would you refer to a particular host in a firewall rule to allow traffic to it? You can't just allow traffic to its IPv6 address, because next week it will have an IPv6 address with a different prefix, because the ISP will have assigned the network a different prefix.
How do you then actually configure a firewall to allow inbound traffic to that host on some port? In ip6tables it looks like there's a --dest option to match by destination, but that only seems to let you put in an entire address and not e.g. a suffix of the address which you can ensure is kept static for a host. From the man page:
[!] -s, --source address[/mask][,...]
Source specification. Address can be either a network name, a
hostname, a network IP address (with /mask), or a plain IP ad‐
dress. Hostnames will be resolved once only, before the rule is
submitted to the kernel. Please note that specifying any name
to be resolved with a remote query such as DNS is a really bad
idea. The mask can be either an ipv4 network mask (for ipta‐
bles) or a plain number, specifying the number of 1's at the
left side of the network mask. Thus, an iptables mask of 24 is
equivalent to 255.255.255.0. A "!" argument before the address
specification inverts the sense of the address. The flag --src
is an alias for this option. Multiple addresses can be speci‐
fied, but this will expand to multiple rules (when adding with
-A), or will cause multiple rules to be deleted (with -D).
[!] -d, --destination address[/mask][,...]
Destination specification. See the description of the -s
(source) flag for a detailed description of the syntax. The
flag --dst is an alias for this option.
Is there a way to handle this with ip6tables? Is there some other layer over ip6tables that is supposed to generate rules that change as the network is renumbered, that everyone is actually using? Is there some kind of ip6tables plugin that can let me match traffic that will go to a particular host even if the network number changes? Do other OS firewalls handle this differently?
