firewall: link-local addresses and sysctls