IPv6: what is configurable and what is not observable#
This page exists because the honest answer is a boundary, not a procedure. IPv6 on a Wheelhouse router is configurable and not observable. Everything the configuration tree can express, you can write and commit. Most of what the pages show you is IPv4.
Read this before you plan an IPv6 deployment on this platform, not after.
What works#
| Area | Where |
|---|---|
| Addresses on interfaces | The interface panel takes any address, v4 or v6 |
| Firewall rules, both directions | Firewall — rules has a full IPv6 family with its own chains and counters |
| Firewall groups | ipv6-address-group and ipv6-network-group — Use groups instead of literals |
| Router advertisements | Hand out IPv6 with router advertisements — prefixes, RDNSS, lifetimes, the managed and other flags |
| The DHCPv6 server | The same page |
| Static routes | set protocols static route6 … commits; see the limits below |
| The installer's firewall | Writes a full IPv6 default-drop ruleset, including all of ICMPv6 and the DHCPv6 client |
| The OPNsense importer | Writes an IPv6 mirror of the ruleset it generates, so a migrated box is closed on both families |
What does not#
The one thing to get right#
Filter both families or you have filtered neither. A box closed on IPv4 and open on IPv6 is open, and the family nobody looks at is the one that gets left open. A provider can bring IPv6 up without asking you.
The installer's firewall checkbox writes both families, which is why leaving it ticked matters. Check:
show configuration commands | match 'firewall ipv6'An empty answer on a box with a v4 ruleset is the failure this page is about.
If the image turns out to have no firewall ipv6 node at all, the installer says so at the
end rather than committing a v4-only ruleset silently. Look for that message.
Two rules that are not optional#
Accept all of ICMPv6 on input. Not just echo. Neighbour discovery and path MTU discovery are ICMPv6; a router that drops them loses its own default route and then breaks every large packet it forwards.
set firewall ipv6 input filter rule 30 action accept
set firewall ipv6 input filter rule 30 description 'ICMPv6 (neighbour discovery, path MTU)'
set firewall ipv6 input filter rule 30 protocol icmpv6Admit the DHCPv6 client on the WAN, or a delegated prefix never arrives from a provider that uses DHCPv6-PD.
set firewall ipv6 input filter rule 40 action accept
set firewall ipv6 input filter rule 40 description 'DHCPv6 from the provider'
set firewall ipv6 input filter rule 40 inbound-interface name eth1
set firewall ipv6 input filter rule 40 protocol udp
set firewall ipv6 input filter rule 40 destination port 546Both are in the ruleset the installer writes, and both are in the one the OPNsense importer generates.
Handing addresses to the LAN#
Hand out IPv6 with router advertisements covers
service router-advert: prefixes, resolvers, lifetimes, and the managed and other-config
flags that tell clients whether to also ask DHCPv6.
Check it worked#
Everything on this page is checked from the console, because that is where the IPv6 views are.
show interfaces ethernet eth0
show ipv6 route
show ipv6 neighbors
show configuration commands | match 'firewall ipv6'And from a client:
ping -6 -c 3 2001:db8::1
curl -6 -s https://ifconfig.coSee also#
- A default-drop ruleset that admits what you meant
- Hand out IPv6 with router advertisements
- Working from the console
- Known security gaps
Checked against docs/security.md ·
docs/install.md ·
ui/src/pages/Routes.tsx ·
ui/src/pages/DhcpExtras.tsx ·
tools/opnsense-import.py