# dual-stack on steroids

## descr

let's consider a DMZ or user network.
we want a protection of some kind for the internal hosts not to be reachable from outside.

and in case of the a DMZ or any internal network containing servers,
we also want stable IPs within (be it static or somehow persistent).

## playbook flavors

therefore this playbook allows to PoC few different things:

1. protecting network segment with NAT66 (type `nat4466`)
2. protecting network segment with IP6 filtering (type `nat4400`)
3. same but using SLAAC instead of static ip6 addressen
3. same but using DHCPv9 individual address instead of static ip6 addressen

### protecting network segment

see https://pub.nethence.com/network/nat4466

see https://pub.nethence.com/network/nat4400

### static vs. persistent ip6 addressen

we want presistent IPs on those hosts.

we can of course consider static ip6 addresses.

otherwise SLAAC _might_ be enough as long as network interfaces don't change
(the MAC defines the `/64` interface identifier).

however DHCPv6's DUID (client-id) is preferred as it allows to make IP persistent
(though dynamic) whatever the NIC.
besides, you're not stuck to `/64` and can use any prefix you like.