I have a fairly simplistic pfSense setup. IPv6 is provided through a Hurricane Electric tunnel.
Something on my home LAN is sending traffic from an odd-looking address, and so it's getting blocked, because my outgoing rules only allow traffic from the routed network defined by my tunnelbroker, within the subnet used by my instance of radvd.
Here's the traffic being blocked:
Rule - default deny rule IPv6
Source - [my Hurricane IPv6 LAN prefix]:ffff:ffff:ffff:ffe2
Destination - various, including 2001:41d0:8:eab2::1 which has no DNS record and RIPE says is owned by someone in France
Protocol - UDP
Ports look dynamic on both source and destination (including 51413, 49001, 30295...)
I'm running radvd as a DHCP6 server on LAN, and that source address is outside of both the DHCP range and the LAN net range.
I can also confirm that the source address does not appear in the NDP table, so I don't know the culprit's MAC.
What is this traffic? What application would be causing it? Is it innocuous or should it continue to be blocked?