In case of IPv4 we have
net.ipv4.conf.all.send_redirects flag, but it's not available for IPv6. Is there anything better than this?
ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j DROP
For some reason, Linux kernel wrongly assumes that IPsec ESP packets target the same network as the unencrypted one. For example, if a Linux box (acting as IPsec server) receives the packet from the network A directed to the VPN network B, and encrypted packet needs to be sent over the same network A, it tell the source host "Hey, the packet is directed to the network A, you are connected to the same network so you can send this packet youself" using ICMP Redirect packet. The kernel doesn't understand that sending encrypted packet to the network A is not the same as sending unencrypted packet to the network A.