Refine external IPv6 operator check

ops/maintenance/check-external-operator.sh

@@ -17,6 +17,21 @@ else
   echo "FRITZBox TR-064 descriptor not reachable at $FRITZBOX_URL"
 fi
 
+if ipv6_fw="$(
+  curl -fsS --max-time 5 \
+    -H 'Content-Type: text/xml; charset="utf-8"' \
+    -H 'SOAPACTION: "urn:schemas-upnp-org:service:WANIPv6FirewallControl:1#GetFirewallStatus"' \
+    --data '<?xml version="1.0"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:GetFirewallStatus xmlns:u="urn:schemas-upnp-org:service:WANIPv6FirewallControl:1" /></s:Body></s:Envelope>' \
+    http://192.168.178.1:49000/igd2upnp/control/WANIPv6Firewall1
+)"; then
+  firewall_enabled="$(printf '%s\n' "$ipv6_fw" | sed -n 's:.*<FirewallEnabled>\(.*\)</FirewallEnabled>.*:\1:p')"
+  pinhole_allowed="$(printf '%s\n' "$ipv6_fw" | sed -n 's:.*<InboundPinholeAllowed>\(.*\)</InboundPinholeAllowed>.*:\1:p')"
+  echo "IPv6 FirewallEnabled: ${firewall_enabled:-unknown}"
+  echo "IPv6 InboundPinholeAllowed: ${pinhole_allowed:-unknown}"
+else
+  echo "FRITZBox IPv6 firewall status not reachable via TR-064."
+fi
+
 section "Host IPv6"
 global_ipv6="$(
   ip -6 addr show scope global \