firewall6: first implementation of ingress filtering

TODO: also for ipv6 uplink...