IPv6: what is configurable and where it is observable#

Read this before planning an IPv6 deployment on this platform.

What works#

Area	Where
Addresses on interfaces: static, DHCPv6, SLAAC, EUI-64	Network → IPv6 → Addressing; the interface panel takes static addresses too
A prefix from the provider, divided among your networks	Network → IPv6 → Prefix delegation
Router advertisements: prefixes, DNS servers, search domains, the DHCPv6 flags	Network → IPv6 → Router advertisements — Hand out IPv6 with router advertisements
The DHCPv6 server	DHCP — IPv6
Static routes	Static routes edits IPv6 routes beside IPv4 ones and shows the IPv6 forwarding table
BGP over IPv6	BGP / OSPF: IPv6 neighbours, the IPv6 unicast family and the networks it announces
Firewall rules, both directions	Firewall — rules has a full IPv6 family with its own chains and counters
Firewall groups	IPv6 address and network groups — Use groups instead of literals
The installer's firewall	Writes a full IPv6 default-drop ruleset, including all of ICMPv6 and the DHCPv6 client
The OPNsense importer	Writes an IPv6 mirror of the ruleset it generates, so a migrated box is closed on both families

Network → IPv6 → Status shows what the router holds: addresses with their real scope, the IPv6 forwarding table, the neighbour table and the IPv6 firewall counters.

What does not#

The one thing to get right#

Filter both families or you have filtered neither. A box closed on IPv4 and open on IPv6 is open, and a provider can bring IPv6 up without asking you.

The installer's firewall checkbox writes both families, which is why leaving it ticked matters. Network → IPv6 shows IPv6 firewall rule sets: 0 with IPv6 traffic is not filtered on a router that has no IPv6 rule set — the state policy alone does not count.

Two rules that are not optional#

Both are input rules in the IPv6 family on Firewall, and both are in the ruleset the installer writes and the one the OPNsense importer generates.

Accept all of ICMPv6. Not just echo. Neighbour discovery and path MTU discovery are ICMPv6; a router that drops them loses its own default route and then breaks every large packet it forwards.

Accept the DHCPv6 client on the WAN (UDP port 546), or a delegated prefix never arrives from a provider that uses DHCPv6 prefix delegation.

Getting addresses to the LAN#

Prefix delegation → Request a prefix on the WAN, delegated to the LAN interface with subnet ID 0 and interface address 1.
Router advertisements → Advertise on an interface: the LAN, prefix ::/64, and a DNS server — the router's own LAN address, if it answers DNS.

Hand out IPv6 with router advertisements explains the choices.

Check it worked#

On Network → IPv6 → Status: a global address on the LAN interface under Routable addresses, and a default route (::/0) in the forwarding table. And from a device on the LAN:

bash

ping -6 -c 3 2001:db8::1
curl -6 -s https://ifconfig.co