From 8584ca56a88a4bfe8192e6525bd0f04c836cd0bb Mon Sep 17 00:00:00 2001
From: Ryan Goodfellow <ryan.goodfellow@oxide.computer>
Date: Fri, 20 Feb 2026 04:27:39 +0000
Subject: [PATCH] allow link-local multicast on ingress ports

---
 dpd/p4/sidecar.p4 | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/dpd/p4/sidecar.p4 b/dpd/p4/sidecar.p4
index 2cfef006..217f5b83 100644
--- a/dpd/p4/sidecar.p4
+++ b/dpd/p4/sidecar.p4
@@ -746,7 +746,11 @@ control NatIngress (
 				hdr.inner_eth.ether_type = hdr.vlan.ether_type;
 				hdr.vlan.setInvalid();
 			}
-		} else if (meta.uplink_ingress && !meta.is_switch_address) {
+		} else if (
+			meta.uplink_ingress &&
+			!meta.is_switch_address &&
+			!meta.is_link_local_mcastv6
+		) {
 			// If this packet arrived on an Uplink port and it
 			// wasn't addressed to the switch or to an established
 			// NAT range, then drop it. This lets us forward traffic