Index: sbin/pfctl/pfctl_parser.c =================================================================== --- sbin/pfctl/pfctl_parser.c +++ sbin/pfctl/pfctl_parser.c @@ -1366,6 +1366,9 @@ last_if = p->ifname; if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET && got4) continue; + if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && + IN6_IS_ADDR_LINKLOCAL(&p->addr.v.a.addr.v6)) + continue; if ((flags & PFI_AFLAG_NOALIAS) && p->af == AF_INET6 && got6) continue; if (p->af == AF_INET) Index: share/man/man5/pf.conf.5 =================================================================== --- share/man/man5/pf.conf.5 +++ share/man/man5/pf.conf.5 @@ -1511,7 +1511,7 @@ Host names may also have the .Ar :0 option appended to restrict the name resolution to the first of each -v4 and v6 address found. +v4 and non-link-local v6 address found. .Pp Host name resolution and interface to address translation are done at ruleset load-time. Index: sys/netpfil/pf/pf_if.c =================================================================== --- sys/netpfil/pf/pf_if.c +++ sys/netpfil/pf/pf_if.c @@ -553,7 +553,8 @@ if ((flags & PFI_AFLAG_PEER) && !(ifp->if_flags & IFF_POINTOPOINT)) continue; - if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 && + if ((flags & (PFI_AFLAG_NETWORK | PFI_AFLAG_NOALIAS)) && + af == AF_INET6 && IN6_IS_ADDR_LINKLOCAL( &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr)) continue;