Comment by tjgq

At least with a decent, non-greedy ISP you have the option of turning off said connection tracking and enjoy your fully routable /48. But I do understand how it remains a problem when most people don't know or want to do that.

Ideally, there could be some kind of uPnP-like protocol to open ports on an IPv6 middlebox, so that you can have a firewall on by default but still be able to punch a hole through it, without user intervention, when an application needs so.

Maybe there is; I haven't checked.