Allow traffic through a firewall to a dynamic IPv6 address
Expanding on the comment from @joseph-sible-reinstate-monica , you could use:
-A FORWARD -d 2001::1122:3344:aabb:ccdd/ffff::ffff:ffff:ffff:ffff -j ACCEPT
(yes, you can use a netmask with non-contiguous bits, for situations just like this.