An apparatus having a corresponding computer program and method comprises a plurality of ports to receive packets each associated with source and destination Internet protocol version 6 (IPv6) addresses; a site circuit to determine a source site for the source IPv6 address, and a destination site for the destination IPv6 address; a scope circuit to determine a source scope level for the source IPv6 address, and a destination scope level for the destination IPv6 address; a command circuit to select one of a plurality of actions for each of the packets based on the source site and source scope level for the source IPv6 address associated with the packet and the destination site and destination scope level for the destination IPv6 address associated with the packet; wherein the plurality of actions comprises forwarding the packet according to the destination IPv6 address associated with the packet, and dropping the packet.