IPv6 Firewall Rule for /64 Assigned Starlink Address

I'm using StarLink as the ISP for a remote site I manage. StarLink doesn't supply static address for any kind of a "reasonable" price but they do provide a "reasonably stable" IPv6 /64 address. I have the StarLink router in bypass mode and am using a GL.iNet GL-MT6000 (Flint 2) router running the most current version of OpenWRT (24.10.4.x).

I have a simple server set up on the LAN side (RPi 5) that I've configured to "self assign" it's address via it's MAC address (I know, not the safest). So, that server ends up with something like "2605:cccc:aaaa:6666:da3a:ddff:fe31:0aaa" where the last four groups are stable. I use the NoIP service running their Dynamic Update Client (aka DUC) in IPv6 mode to keep the mapping of the URL name (like MySpecial.WebServer.org) to the IPv6 global address.

The issue is that whenever StarLink feels like pushing an update in their system the /64 prefix can change. The server then picks up the new prefix address and DUC see that address and updates the URL/address mapping. Then, the Traffic Rule in LuCI fails to forward traffic to the server.

I can use Port forwarding by that isn't really the idea with IPv6 management so I want a clean Traffic Rule for IPv6 that masks out the 64 bit prefix, matches on the 64 bit suffix, and forwards the request to the server.

I saw a very good YouTube by OneMarcFifty that implies I can just add a rule using the following mask and things should work:

/::ffff:ffff:ffff:ffff

But, before I drive all the way to that particular remote site and start messing with the firewall rule I'm hoping someone with better knowledge of OpenWRT can confirm the above. When I ask ChatGPT "it" doesn't have a very solid answer, and often times I've found that the dang AI tools are just giving me a "best guess" or otherwise making up stuff based on a lot of assumptions. I'd rather trust feedback from a HUMAN!

What's the server, what's the traffic rule?

Not sure what you're asking that I haven't already answered im the original write up, but I'll give it a try.

The server is a RPi that is self assigning the suffix address using its MAC address and getting the prefix as provided by the ISP snd router. The rule i want to make (no rule yet, just port forwarding) is one that will work to allow several types of traffic thru the router and to the RPi, even when the ISP (StarLink) changes the prefix (/64) on occasion.

The way I saw to do that was to create a traffic rule that uses the mask I mentioned previously, and hopefully allow the traffic thru. Not sure if that clarifies so sorry if I didn't understand your request.

Yep. I've looked at that. I'll try using the following and see how it goes....

/::0000:ffff:ffff:ffff:ffff

As I get a /64 delegation from Starlink...

The syntax is ::aaaa:aaaa:aaaa:aaaa/-64 to ignore the first 64 bits and match on the last part.

I've added the rule in the "::xxxx:xxxx:xxxx:xxxx/-64" format using the RPis self assigned address and things seem to be working. The real test will be when StarLink reboots or refreshes their /64 prefix, but I'm hopeful...