Specifically for the shibby build I guess:
I cannot open ports to a subnet in my VLAN, only specific ports.
Also note: The internet protocol is a point to point protocol, IPv4 NAT breaks this, firewalls on ipv6 break this. I *need* to open up my entire subnet to the internet, that is what the internet protocol was intended for. I can understand the default behaviour of not allowing any inbound traffic, because that is what IPv4 NAT does and it protects people who don't understand computer networks.. but please allow me to override this..