Quoting nf bugzilla: -------- Using the following for reverse path filtering breaks IPv6 duplicate address detection: table inet ip46_firewall { chain ip46_rpfilter { type filter hook prerouting priority raw; fib saddr . iif oif missing log prefix "RPFILTER: " drop } } This is because packets from :: to ff02::1:ff00/104 will be dropped and thus other hosts on the network cannot detect that this host already has the same address assigned. The problem can be worked around in nft rules by handling such packets specially but I guess it should work as is. In the kernel in ip6t_rpfilter.c the function rpfilter_mt() checks for saddrtype == IPV6_ADDR_ANY. nft_fib_ipv6.c doesn't seem to have an equivalent check for this special case. -------- First patch adds a test case for this, second patch makes icmpv6 from any to link-local bypass the fib lookup, just like loopback packets. Florian Westphal (2): selftests: netfilter: add fib test case netfilter: ipv6: skip ipv6 packets from any to link-local net/ipv6/netfilter/nft_fib_ipv6.c | 22 +- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/nft_fib.sh | 221 +++++++++++++++++++ 3 files changed, 240 insertions(+), 5 deletions(-) create mode 100755 tools/testing/selftests/netfilter/nft_fib.sh -- 2.31.1