RFC 4291, IP Version 6 Addressing Architecture explains Link-Local addressing:
2.5.6. Link-Local IPv6 Unicast Addresses
Link-Local addresses are for use on a single link. Link-Local
addresses have the following format:
| 10 |
| bits | 54 bits | 64 bits |
You need to remember that ping is bidirectional. You send out an ICMP echo request, and you hope to get back an ICMP echo reply. That means that the replying device must also have a route back to the original sender.
You did not include the R3 routing table, but it would seem that R3 does not have a route back to the source of the ICMP echo request. It is ...
There are (at least) two main reasons:
The assumption is that you control the "inside" network. So,
presumably, you're not doing the spoofing.
Not every device needs to be NATted. You might have some devices
that use addresses that don't need translation.
From my understanding of your comment:
I'm trying to do split tunneling, I want a list of ranges not being
routed through the tunnel, so I need a list of routes that doesn't
match with these ranges.
you really don't need this list.
Routing works primarily by selecting the more specific route first.
So in a split tunneling scheme:
you have a ...
Many routers do not route a packet back out of the interface it was received. They may require explicit configuration to do that.
Routing "backwards" is inefficient since those packets need to cross a subnet multiple times. Your scenario isn't very practical since most often, you'd have a single router taking care of all routing into and out of a subnet. ...