> It's the PARANOID option of TCP_WRAPPERS (which NetBSD makes the
> default behavior).  The purpose is to try to weed out spoofed DNS
> responses, and some fake IP source addresses.  Just makes it a tiny
> bit harder for the bad guys.
> --
> The opinions expressed in this message are mine,

BTW how to specify IPv6 address range in /etc/hosts.allow?

with IPv6 i could do
a.b.c. which mean a.b.c.0/24

with IPv6 only single IP in [] brackets works