So i finally was able to get my ER605 configured correctly and my provider is giving me a v6 ip address. Until now I was unable to get around the CGNAT issues of IPv4. I enabled v6 on one of my LAN's and yay I could reach the server from the outside.....but wait, theres no security for IPv6 on this device at all so what do I do??????. I am thinking since each LAN i have is on a dedicated physical port on the switch, I can move all internet facing devices moved to the last open port I have on the switch and only enable ipv6 for that port/network, essentially exposing only the devices on the 1 port to the internet and isolating the rest of thge ipv4 devices from that exposure (with the understanding that if security is breached on any IPv6 lan devices, they could potentially access the other internal LAN's). Are my assumptions wrong on this configuration or is there a better way to do this?