If the prefix is dynamic there is a (undocumented?) feature[1] in iptables that allows to only match an EUI-64 or custom static suffix, which should be enough f

If the prefix is dynamic there is a (undocumented?) feature[1] in iptables that allows to only match an EUI-64 or custom static suffix, which should be enough for home networks. I'm mentioning this here because I looked for hours for a solution the first time I had to deal with this. Basically you specify the destination address as: ::[suffix]/::ffff:ffff:ffff:ffff or, if you are lucky enough to get a /56 prefix and want to control a single /64 subnet at a time: ::[subnet]:[suffix]/::00ff:ffff:ffff:ffff:ffff [1]: http://blog.dupondje.be/?p=17 http://blog.dupondje.be/?p=17