For some reason, rules without ipv6.flags set (and proto set?) do not match at all at least on Linux 3.10. So with this patch, they do (and it took me a while to find out, sigh)
Merge pull request #75 from fingon/fix-linux3.10-ipv6-pinhole

netfilter: Linux 3.10(?) IPv6 firewall pinhole fix