It enables us to control link-local connections by interface like this: ALL : [fe80::%ed0]/10 : allow ALL : [fe80::]/10 : deny
Rest of build to follow.