Merci, je commence à comprendre. Le pire c'est qu'il y a les détails sur le générateur lorsqu'on clique sur les règles avancées. Ça modifie le nombre de ports réservés et de ranges en fait.
J'ai donc réessayé avec 192.168.46.1/32, et un offset à 0 ce qui nous fait 16384 ports pour 4 CE et la commande jool kivabien jool_mapt -i "BR" fmrt add 2001:db8:9400::/60 192.168.46.1/32 2 0
Et... it works !
root@debian:~# tcpdump -i enp0s8 tcp port 80
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp0s8, link-type EN10MB (Ethernet), snapshot length 262144 bytes
01:28:07.257591 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49182 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [S], seq 3790998064, win 64240, options [mss 1440,sackOK,TS val 2133491635 ecr 0,nop,wscale 7], length 0
01:28:07.508276 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [S], seq 3576058630, win 64240, options [mss 1440,sackOK,TS val 2133491886 ecr 0,nop,wscale 7], length 0
01:28:07.541135 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49183: Flags [S.], seq 453561669, ack 3576058631, win 65160, options [mss 1460,sackOK,TS val 1309919073 ecr 2133491886,nop,wscale 10], length 0
01:28:07.541546 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 2133491919 ecr 1309919073], length 0
01:28:07.541634 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [P.], seq 1:361, ack 1, win 502, options [nop,nop,TS val 2133491920 ecr 1309919073], length 360: HTTP: GET / HTTP/1.1
01:28:07.581605 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49183: Flags [.], ack 361, win 64, options [nop,nop,TS val 1309919110 ecr 2133491920], length 0
01:28:07.586303 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49183: Flags [.], seq 1:1429, ack 361, win 64, options [nop,nop,TS val 1309919112 ecr 2133491920], length 1428: HTTP: HTTP/1.1 200 OK
01:28:07.587232 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [.], ack 1429, win 501, options [nop,nop,TS val 2133491965 ecr 1309919112], length 0
01:28:07.590272 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49183: Flags [P.], seq 1429:2857, ack 361, win 64, options [nop,nop,TS val 1309919112 ecr 2133491920], length 1428: HTTP
01:28:07.591359 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49183: Flags [P.], seq 2857:3488, ack 361, win 64, options [nop,nop,TS val 1309919112 ecr 2133491920], length 631: HTTP
01:28:07.591603 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [.], ack 2857, win 501, options [nop,nop,TS val 2133491969 ecr 1309919112], length 0
01:28:07.592460 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49183 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [.], ack 3488, win 501, options [nop,nop,TS val 2133491970 ecr 1309919112], length 0
01:28:07.615214 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49184 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [S], seq 1856372793, win 64240, options [mss 1440,sackOK,TS val 2133491993 ecr 0,nop,wscale 7], length 0
01:28:07.646146 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49184: Flags [S.], seq 3639631816, ack 1856372794, win 65160, options [mss 1460,sackOK,TS val 1309919179 ecr 2133491993,nop,wscale 10], length 0
01:28:07.646825 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49184 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 2133492025 ecr 1309919179], length 0
01:28:07.646991 IP6 2001:db8:9400:c:0:c0a8:2e01:3.49184 > 4464:ff9b:ce:0:33:9e9a:a900:0.http: Flags [P.], seq 1:330, ack 1, win 502, options [nop,nop,TS val 2133492025 ecr 1309919179], length 329: HTTP: GET /connectivity.php HTTP/1.1
01:28:07.679802 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49184: Flags [.], ack 330, win 64, options [nop,nop,TS val 1309919215 ecr 2133492025], length 0
01:28:07.683130 IP6 4464:ff9b:ce:0:33:9e9a:a900:0.http > 2001:db8:9400:c:0:c0a8:2e01:3.49184: Flags [P.], seq 1:577, ack 330, win 64, options [nop,nop,TS val 1309919216 ecr 2133492025], length 576: HTTP: HTTP/1.1 200 OK
root@debian:~# tcpdump -i enp0s3 tcp port 80
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), snapshot length 262144 bytes
01:29:20.341833 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [S], seq 4137385102, win 64240, options [mss 1440,sackOK,TS val 2133564723 ecr 0,nop,wscale 7], length 0
01:29:20.371742 IP fr.archive.ubuntu.com.http > 192.168.46.1.49185: Flags [S.], seq 1165256997, ack 4137385103, win 65160, options [mss 1460,sackOK,TS val 1309991908 ecr 2133564723,nop,wscale 10], length 0
01:29:20.372454 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 2133564754 ecr 1309991908], length 0
01:29:20.372516 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [P.], seq 1:361, ack 1, win 502, options [nop,nop,TS val 2133564754 ecr 1309991908], length 360: HTTP: GET / HTTP/1.1
01:29:20.408268 IP fr.archive.ubuntu.com.http > 192.168.46.1.49185: Flags [.], ack 361, win 64, options [nop,nop,TS val 1309991942 ecr 2133564754], length 0
01:29:20.408762 IP fr.archive.ubuntu.com.http > 192.168.46.1.49185: Flags [.], seq 1:1429, ack 361, win 64, options [nop,nop,TS val 1309991944 ecr 2133564754], length 1428: HTTP: HTTP/1.1 200 OK
01:29:20.410092 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [.], ack 1429, win 501, options [nop,nop,TS val 2133564791 ecr 1309991944], length 0
01:29:20.411907 IP fr.archive.ubuntu.com.http > 192.168.46.1.49185: Flags [P.], seq 1429:2857, ack 361, win 64, options [nop,nop,TS val 1309991944 ecr 2133564754], length 1428: HTTP
01:29:20.412240 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [.], ack 2857, win 501, options [nop,nop,TS val 2133564794 ecr 1309991944], length 0
01:29:20.412518 IP fr.archive.ubuntu.com.http > 192.168.46.1.49185: Flags [P.], seq 2857:3488, ack 361, win 64, options [nop,nop,TS val 1309991944 ecr 2133564754], length 631: HTTP
01:29:20.412769 IP 192.168.46.1.49185 > fr.archive.ubuntu.com.http: Flags [.], ack 3488, win 501, options [nop,nop,TS val 2133564794 ecr 1309991944], length 0
01:29:20.432203 IP 192.168.46.1.49186 > fr.archive.ubuntu.com.http: Flags [S], seq 902139922, win 64240, options [mss 1440,sackOK,TS val 2133564813 ecr 0,nop,wscale 7], length 0
01:29:20.463630 IP fr.archive.ubuntu.com.http > 192.168.46.1.49186: Flags [S.], seq 1840750512, ack 902139923, win 65160, options [mss 1460,sackOK,TS val 1309991998 ecr 2133564813,nop,wscale 10], length 0
01:29:20.464133 IP 192.168.46.1.49186 > fr.archive.ubuntu.com.http: Flags [.], ack 1, win 502, options [nop,nop,TS val 2133564845 ecr 1309991998], length 0
01:29:20.464253 IP 192.168.46.1.49186 > fr.archive.ubuntu.com.http: Flags [P.], seq 1:330, ack 1, win 502, options [nop,nop,TS val 2133564845 ecr 1309991998], length 329: HTTP: GET /connectivity.php HTTP/1.1
01:29:20.500685 IP fr.archive.ubuntu.com.http > 192.168.46.1.49186: Flags [.], ack 330, win 64, options [nop,nop,TS val 1309992034 ecr 2133564845], length 0
01:29:20.503893 IP fr.archive.ubuntu.com.http > 192.168.46.1.49186: Flags [P.], seq 1:577, ack 330, win 64, options [nop,nop,TS val 1309992035 ecr 2133564845], length 576: HTTP: HTTP/1.1 200 OK
Maintenant, je n'ai plus qu'à tester avec plusieurs CPE et aussi retenter avec un /30 vu que ça n'avait pas l'air de vouloir fonctionner.
Et à priori pour l'interface virtuelle, la link local seule est normal, il n'y a pas eu apparition de l'ipv4.