One of my favourite features of v6 is it explicitly permits, and caters for, multiple addresses on an interface. This means you could theoretically have a unique address per application, within multiple prefixes if they’re available.

Couldn't you do that with v4? Or maybe that was only with bridge interfaces. hmm

Multiple v4 addresses are possible, like secondary/virtual configurations, but it’s not a concept built into the formal specifications, and usually constrained to advanced networking equipment.

With v6, multiple addresses, across multiple prefixes, are first class features in even the dumbest nodes. I honestly consider it one of the most valuable features of v6.

I personally have all my internal services accessible only on addresses under ULA prefixes, which intrinsically prevents them from being accessed outside of my network, no firewall required. Using WireGuard permits remote access when needed.

This is... interesting. At first I thought it was just like the v4 loopback range, but like you mentioned it opens up the possibility of routing between two on-machine networks. I'm gonna have to digest that idea for a while.

ULA prefixes are basically equivalent to RFC1918 v4 private ranges. I have a unique ULA prefix wherever I have a RFC1918 range. Again, the key feature is they exist alongside GUA (public) prefixes, not instead of them. The key is the routing stack explicitly constrains reachability to within your administrative domain.

What's a useful way to manage clients identities? Like before, static MAC would allow the assignment of a static IP, then that device could be handled by the firewall using that IP. But with these random addresses is there any way to use targeted firewalling/monitoring for specific devices?

The way you’re supposed to identify hosts for v6 configuration is with a DUID instead of a MAC. That said, I don’t consider it necessary to keep track of individual hosts except for servers or other requirements for static addresses.

A better way of managing it is to group common hosts within a specific /64, and set policy specific to that. The hosts can then cycle through IADs as normal. It’s why it’s so important for ISPs to provide a minimum of /60 or /56 via PD as a default.

The only exception is if you need historical tracking of host activity, but any environment in that position is already heavily infected with surveillance urchins.