Firewalld breaking IPv6, it not working from inside a incus container on tumbleweed 20250818

[RoyBellingan2]

After creating a container with incus I tried to ping the incusbr0

root@ns3261313:~# ip addr show incusbr0: 
5: incusbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 10:66:6a:3a:5f:6d brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.1/8 brd 10.255.255.255 scope global incusbr0
       valid_lft forever preferred_lft forever
    inet6 fd42:c82b:9109:8960::1/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::1266:6aff:fe3a:5f6d/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever

From inside the container

ping fd42:c82b:9109:8960::1

is NOT working (but if I disable and re-enable ipv6 inside the container it will work for a brief moment!!!)

if I instead ping on fe80::1266:6aff:fe3a:5f6d
Is working fine

If I stop firewalld (in the host) it start to work again… Not only the bridge but also a remote address (ping6 google.com)

And that is all I can say or do, from here I tried to google and chatgpt and look around but I was not able to find a solution.

As I have not done any special config on the firewall (just open a few tcp port) I think this is a bug.

The same issue happens also on a tumbleweed 20250630 and 20250822)

[arvidjaar]

Show network configuration of guest.

Run

dumpcap -i incusbr0 -w /tmp/cap1.pcapng

on the host and the same command on the guest for the corresponding guest interface and execute ping that does not work.

Stop firewalld and repeat the same storing results in the different files. Provide all four binary files.