Allow icmpv6 neighbor-solicitation

On my statically-configured instance, the neighbor-solicitation packets to the
gateway have a link local fe80:: source address and the global unicast address
of the gateway as destination.

conf/hook_post-iptable-rules

@@ -43,6 +43,7 @@ do
 done
 
 ip6tables -w -A vpnclient_out -d fd00::/8,fe80::/10 -j ACCEPT
+ip6tables -w -A vpnclient_out -s fe80::/10 -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
 ip6tables -w -A vpnclient_out -p udp --dport 5353 -d ff02::fb -j ACCEPT
 ip6tables -w -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
 ip6tables -w -A vpnclient_out -j DROP