+ -p icmp ! -f --icmp-type echo-reply \
+ -m mark --mark $from_untrusted/$MASK_FROM \
+ -m state --state ESTABLISHED
+run ip6tables -A FORWARD -j ACCEPT \
+ -p ipv6-icmp --icmpv6-type echo-request \
+ -m ipv6header --soft ! --header frag \
+ -m mark --mark $to_untrusted/$MASK_TO
+run ip6tables -A FORWARD -j ACCEPT \
+ -p ipv6-icmp --icmpv6-type echo-reply \
+ -m ipv6header --soft ! --header frag \