+These filters belong to a VM's network interface and are mainly used to prevent
+IP spoofing. If such a set exists for an interface then any outgoing traffic
+with a source IP not matching its interface's corresponding ipfilter set will
+be dropped.
+
+For containers with configured IP addresses these sets, if they exist (or are
+activated via the general `IP Filter` option in the VM's firewall's 'options'
+tab), implicitly contain the associated IP addresses.
+
+For both virtual machines and containers they also implicitly contain the
+standard MAC-derived IPv6 link-local address in order to allow the neighbor
+discovery protocol to work.