Man I've been pulling my hair out for 2 days trying to figure out where those rules were getting generated from. I was doing testing and this issue also persists on pfsense. This ruleset was preventing me from running an ipv4 bridge on one pair of interfaces and ipv6 prefix delegation on a separate pair. the default ipv6 prefix kept leaking through the bridged pair no matter what ipv6 deny rules I set on that bridgeed set. The one issue I see is that any update will undo these changes. Do you think its worthwhile to submit a feature request?