@@ -193,6 +193,9 @@ func validateIPv6Subnet(addr netip.Prefix) error {

 	if !addr.Addr().Is6() || addr.Addr().Is4In6() {

 		return fmt.Errorf("'%s' is not a valid IPv6 subnet", addr)

 	}

+	if addr.Addr().IsMulticast() {

+		return fmt.Errorf("multicast subnet '%s' is not allowed", addr)

+	}

 	if addr.Masked() != linkLocalPrefix && linkLocalPrefix.Overlaps(addr) {

 		return fmt.Errorf("'%s' clashes with the Link-Local prefix 'fe80::/64'", addr)

 	}

@@ -1046,6 +1046,11 @@ func TestValidateFixedCIDRV6(t *testing.T) {

 			input:       "nonsense",

 			expectedErr: "invalid fixed-cidr-v6: netip.ParsePrefix(\"nonsense\"): no '/'",

 		},

+		{

+			doc:         "multicast IPv6 subnet",

+			input:       "ff05::/64",

+			expectedErr: "invalid fixed-cidr-v6: multicast subnet 'ff05::/64' is not allowed",

+		},

 	}

 	for _, tc := range tests {

 		tc := tc