change rules and location of rules for 'Allow forwarding (private) IPs'.

ip6t-firewall-server

@@ -307,8 +307,8 @@ esac
 # --- Pass through Devices Interfaces (not firewalled)
 # -------------
 
+echononl "\tPass through Devices (not firewalled)"
 if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
-   echononl "\tPass through Devices (not firewalled)"
    for _dev in ${unprotected_if_arr[@]} ; do
       if $log_unprotected || $log_all ; then
          $ip6t -A INPUT -i $_dev -j $LOG_TARGET $tag_log_prefix "$log_prefix Not firewalled ${_dev}: "
@@ -322,6 +322,24 @@ if [[ ${#unprotected_if_arr[@]} -gt 0 ]]; then
       $ip6t -A FORWARD -o $_dev -j ACCEPT
    done
    echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - Allow Forwarding certain private Addresses
+# ---
+
+echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
+if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
+   for _ip in ${forward_private_ip_arr[@]}; do
+      $ip6t -t mangle -A PREROUTING -d $_ip -j ACCEPT
+      $ip6t -t mangle -A PREROUTING-s $_ip -j ACCEPT
+   done
+   echo_done
+else
+   echo_skipped
 fi
 
 
@@ -495,26 +513,6 @@ if [[ -f "$conf_ban_ipv6_list" ]] ; then
 else
    echo_skipped
 fi
-
-
-# ---
-# - Allow Forwarding certain private Addresses
-# ---
-
-if [[ ${#forward_private_ip_arr[@]} -gt 0 ]] ; then
-   echononl "\tAllow forwarding (private) IPs / IP-Ranges.."
-   for _ip in ${forward_private_ip_arr[@]}; do
-      $ip6t -A OUTPUT -d $_ip -j ACCEPT
-      $ip6t -A INPUT -s $_ip -j ACCEPT
-      if $kernel_forward_between_interfaces ; then
-         $ip6t -A FORWARD -d $_ip -j ACCEPT
-         $ip6t -A FORWARD -s $_ip -j ACCEPT
-      fi
-   done
-   echo_done
-else
-   echo_skipped
-fi