I have a compliance test that is requiring me to respond to unrecognized next-headers per RFC 2460. I am running a debian 3.16 kernel. My current firewall implementation is dropping these frames per the INPUT rule of DROP by default unless match. I have a few match rules, but they are very specific to items that I want to allow through. Since this is a pretty vanilla frame, if I allow all unrecognized traffic then what is the point of having a firewall? I saw a man page on ip6tables that will allow some header filtering, but my version of ip6tables 1.4.21 does not.
Is there an easy way to allow this specific traffic without opening the firewall up completely?