Hector Martin

Actually I run two PPPoE sessions, and only one (v4) terminates in the Netgear. The other passes through (no NAT or extra routing hop on v6)

Okay. I don't think I would have chosen that. To each his own. You have logical reasons, so no complaint here.

I mean, my only other option was to stick a PPPoE client in my initramfs. Keeping all routing duties on the Netgear wasn't an option (perf).

I get the preference. Why couldn't you put the PPPoE client & creds in the initramfs?

I could, but that'd bloat my initramfs, and require retry scripts to ensure it stays connected, and complicate things.

Also it still wouldn't let me have out of band serial access to this host like I do now with the double NAT trick.

Okay. Why NAT internally? Why not route?

Routing doesn't work on the inbound connections. I'd still need to NAT those.