[geocar]

> there’s still a firewall to configure

All of my desktops and servers and laptops each have their own firewall, and this is good enough to protect against naughty programs who bind to INADDR_ANY instead of ::1 or a uds. I don't need to waste memory and latency on the router doing connection tracking that doesn't buy anything.

> I’m not sure if consumer hardware commonly supports this,

I have not run across consumer hardware that doesn't. I just tried a bunch of netgear, asus, and tplink kit and it was all fine. I've only run into a few ISPs that it didn't work with, and in every case a phone call was able to sort things out (because it had nothing to do with the consumer equipment). I suspect strongly that almost all consumer hardware commonly supports this.

[hamandcheese]

> All of my desktops and servers and laptops each have their own firewall

Sure, but there are plenty of devices on my network that I don’t have that sort of control over (i.e. my light bulbs).

[geocar]

Get different light bulbs; My light bulbs require a password and route-filter. If yours don't, your firewall isn't protecting you if your computer can reach them because someone can just send you and iframe that pokes your light bulbs.