It appears that William Herrin <bill@herrin.us> said:
Now suppose I have a firewall at 199.33.225.1 with an internal network of 192.168.55.0/24. Inside the network on 192.168.55.4 I have a switch that accepts telnet connections with a user/password of admin/admin. On the firewall, I program it to do NAT translation from 192.168.55.0/24 to 199.33.225.1 when sending packets outbound, which also has the effect of disallowing inbound packets to 192.168.55.0/24 which are not part of an established connection.
Or you set up port forwarding for some other device but you mistype the internal address an forward it to the switch. Or the switch helpfully uses UPNP to do its own port forwarding and you forget to turn it off. If you configure your firewall wrong, bad things will happen. I have both IPv6 and NAT IPv4 on my network here and I haven't found it particularly hard to get the config correct for IPv6. Normally the ISP will give you an IPv6 /56 or larger so you can have multiple segments behind the router each with a /64 and different policies for each segment.