Quote Originally Posted by lly View Post
Since you are IPv6 guru, please explain some moments:

Why you use /10 instead of /64 in following rules?
Code:
  ip6tables -A INPUT -s fe80::/10 -j ACCEPT
  ip6tables -A OUTPUT -s fe80::/10 -j ACCEPT
simple explain:

Code:
$ ip -f inet6 add
1: lo: <LOOPBACK,MULTICAST,UP> mtu 16436 qdisc noqueue
    inet6 ::1/128 scope host
3: eth0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100
    inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link
4: eth1: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100
    inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link
5: vlan0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc noqueue
    inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link
6: vlan1: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc htb
    inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link
7: br0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue
    inet6 2001:6a0:1a9:ffff::/64 scope global
    inet6 fe80::21f:c6ff:fe27:e8a7/10 scope link
8: sixtun@NONE: <POINTOPOINT,NOARP,UP> mtu 1280 qdisc noqueue
    inet6 2001:6a0:200:113::2/64 scope global
    inet6 fe80::a05:2001/10 scope link
9: tap0: <BROADCAST,MULTICAST,PROMISC,UP> mtu 1500 qdisc pfifo_fast qlen 100
    inet6 fe80::2ff:7fff:fe20:f7ba/10 scope link
why not /64? because fe80 is link lokal - and not routing in world, only local and this is standard... but you can use /64 - it's only my example script