Good post. And i would like to add for anyone to be able to use hypervisor escape, you also need a vulnerability in the software presented to the internet. And even then, the chance that anyone would waste a zero day on a homelab is pretty slim…
If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.
So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want
I wouldn’t worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.
Edit: The guide: Official documentation for “router on a stick”
I tried this for awhile, but I got occasionally 30 second delays before it starting replying to lookups. It did respond to icmp immediately though.
You’re right that IPv6 doesn’t need NAT for its original purpose (address scarcity). But “there is no NAT in IPv6” isn’t quite accurate: NAT still exists in IPv6
NAT66 (stateful, like NAT44) exists but is discouraged. More relevant is NPTv6, a standardized stateless 1:1 prefix translation, not the many-to-one port-overloaded NAT you’re used to from IPv4. It doesn’t do address+port multiplexing, so it doesn’t break peer-to-peer the way NAT44 does. So the “NAT is the enemy of p2p” argument applies to stateful NAT44-style translation — not really to NPTv6, which preserves end-to-end host addressability and just swaps the prefix.
You can absolutely build a fully functional internal network on ULA (fd00::/8) alone — routing, DNS, services, all independent of any ISP-delegated prefix. But ULA is explicitly non-routable on the public internet, so a pure ULA network is isolated: internal-only, no internet reachability.