Hand out IPv6 with router advertisements#

You will end up with the router advertising an IPv6 prefix on a segment, so clients configure themselves. This is how IPv6 addressing normally works — there is no IPv6 equivalent of "the DHCP server hands out addresses" as the default path.

Read IPv6: what is configurable and what is not observable first. This part works; inspecting the result mostly happens from the console.

Before you start#

The operator role and a licence.
A prefix on the segment — usually from a delegated prefix your provider gave you.
ICMPv6 accepted in the firewall. Router advertisements are ICMPv6. A router that drops them advertises nothing.

Step 1 — Advertise a prefix#

Network → DHCP → IPv6.

set service router-advert interface eth0 prefix 2001:db8:1::/64
set service router-advert interface eth0 name-server 2001:db8:1::1
set service router-advert interface eth0 default-lifetime 1800

Field	Command	Meaning
Prefixes	`prefix <p>`, one line each	What clients build addresses from
Resolvers	`name-server <a>`, one line each	RDNSS — the resolver clients should use
Default lifetime	`default-lifetime <s>`	How long clients treat this router as a default router

Step 2 — Decide about the two flags#

These are the ones people get wrong, because their names describe the protocol rather than the effect.

set service router-advert interface eth0 managed-flag
set service router-advert interface eth0 other-config-flag

Flag	Tells clients
`managed-flag` (M)	Get your address from DHCPv6, not from the prefix
`other-config-flag` (O)	Get other settings — resolvers, domains — from DHCPv6, but build your own address

Neither flag, with a prefix and an RDNSS: clients build their own addresses and use the resolver from the advertisement. That is the simplest arrangement and the one to start from.

Setting managed-flag without running a DHCPv6 server leaves clients waiting for an address that never arrives.

Step 3 — Run DHCPv6, if you set the M or O flag#

The same page has the DHCPv6 server, under service dhcpv6-server shared-network-name <name> subnet <prefix>. Its rows can be removed from the page; a new scope is written from the console or the config tree.

Step 4 — Make sure ICMPv6 is accepted#

set firewall ipv6 input filter rule 30 action accept
set firewall ipv6 input filter rule 30 description 'ICMPv6 (neighbour discovery, path MTU)'
set firewall ipv6 input filter rule 30 protocol icmpv6

All of ICMPv6, not just echo — neighbour discovery and path MTU discovery live there. This rule is in the ruleset the installer writes, so on most boxes it is already present. A default-drop ruleset.

Check it worked#

From a client on the segment:

bash

ip -6 addr show
ip -6 route show

An address built from the advertised prefix, and a default route via the router's link-local address, is the whole answer.

On the router, from the console, because the pages do not show IPv6 routing: