triaxx%NetBSD.org@localhost writes:
| pass stateful out final all # id="2"
| pass stateful in final family inet4 proto tcp flags S/FSRA to
51.159.70.149 port 22 # id="3"
| pass stateful in final family inet6 proto tcp flags S/FSRA to
2001:bc8:1200:d:ec4:7aff:fe0d:b158 port 22 # id="4"
| pass final on lo0 all # id="5"
| block all apply "log" # id="6"
| uzqew% ssh -6 kyroz.triaxx.org
| ssh: connect to host kyroz.triaxx.org port 22: Operation timed out
For IPv6 you also need to pass ipv6-icmp traffic, to handle
neighbour detection (which would ARP for IPv4).
pass final family inet6 proto ipv6-icmp all