After upgrading my ubuntu I noticed that my network interface got another global address within my /64. After som investinagtion I found this was because the newer ubuntu comes with privacy extensions ON by default. In itself this is not a problem, but I had also noticed that a few of my network connections were failing, and the reason is that the network stack favors using the global address with privacy extensions instead of the one generated from MAC. This also applies to connections on the same network, meaning that when I set up connections to a firewalled machine on the same /64, the source address will be random and change over time, meaning that having firewall rules on the destination machine other than "let connections from the same network in" will be meaningless. I'm a bit stumped by this and other than turning the privacy extensions off I wonder what ways I have to deal with the problem? So far I've looked at: - searching for a way to configure privacy extensions not to use the whole lower 64 bits in the address, leaving me some bits within the host identifier to map to my firewall rule. No luck. - rewriting traffic from/to the firewalled machine. While this one is possible I do not want to venture down this particular route. (pun intended) - Assigning the machines to different networks, so I can use the network prefix in my firewall rules. While it looks as if dhcpv6 could handle this, radvd turns into a problem as it is limited to one /64 per network interface. (and the machines in questions are on the same network, so mapping several logical networks to it to solve this problem seems ... stupid) Anyone who can provide me with help on how to have both privacy extensions _and_ firewall host-to-host rules?