

giving out my IP to trusted friends
Just in case you ever get back into it: We regularly see scanners scanning the internet with a million packets per second at work these days. That means it takes them 4000 seconds to scan the entire IPv4 Internet to check who responds on port 3784. So handing out the IP selectively won’t be enough.
I also learned that the hard way privately with my Minecraft server. It was found in a scan and listed on Shodan at some point, and I hadn’t put up a whitelist. Some shitty kids came and destroyed whatever they could find before finally putting up signs to mock me lol
They are so often stateful and fall over when some scanner comes by, or if a light DNS DoS attack happens, compromising the entire access link, when the scanned systems or the DNS server weren’t even bothered by the amount of requests.
They introduce weird unexpected restrictions, like preferring to blackhole our customers traffic rather than accepting some asymmetric routing. And then we get blamed for their setup, which they don’t even know.
They ossify protocol development in general, requiring things like header encryption in QUIC to force them to ignore things that aren’t their business anyway.
They are apparently also expensive as hell, multiple customers have declined upgrades because they don’t have fast enough firewalls and not enough budget to buy faster ones.
Those are the ones that come to mind right now. There are also occasional bugs that make our or our customers lives difficult, but I can’t recall a clear one at the moment.