X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;fp=src%2FPVE%2FFirewall.pm;h=956ccc4d22a251caaae1f5027f47c25b75defcf5;hb=2142a8a9eb32cd25bceee81c5c93e12bff7cee07;hp=0d9a7793f92faabe7531d109e9f6939d3b8ef40e;hpb=1e7107b06881b91b11c6d8e188b25bc839984fb2;p=pve-firewall.git

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 0d9a779..956ccc4 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2985,8 +2985,10 @@ sub generate_ipset_chains {
 		}
 		#http://backreference.org/2013/03/01/ipv6-address-normalization/
 		if ($ver == 6) {
-		    my $ipv6 = inet_pton(AF_INET6, lc($cidr));
-		    $cidr = inet_ntop(AF_INET6, $ipv6);
+		    # ip_compress_address takes an address only, no CIDR
+		    my ($addr, $prefix_len) = ($cidr =~ m@^([^/]*)(/.*)?$@);
+		    $cidr = lc(Net::IP::ip_compress_address($addr, 6));
+		    $cidr .= $prefix_len if defined($prefix_len);
 		    $cidr =~ s|/128$||;
 		} else {
 		    $cidr =~ s|/32$||;