DHCPv6 stateful vs stateless — when each is appropriate, OPNsense config · OPNsense

DHCPv6 has two distinct modes that serve different purposes. Stateful DHCPv6 hands out IPv6 addresses from a configured pool — the equivalent of DHCPv4. Stateless DHCPv6 hands out only “other” configuration (DNS, NTP, search domains) — addresses come from SLAAC, but the operator can still centralise the metadata. The choice between them has real consequences for address stability, central management, and the role of the firewall.

This lesson covers both modes, how OPNsense configures each, and the production scenarios that pick one over the other.

The three modes in practice

In practice, IPv6 host configuration has three modes:

SLAAC only (M=0, O=0). Hosts self-configure their addresses and use whatever DNS they have (often nothing automatic). Simplest, but no central management.
SLAAC + stateless DHCPv6 (M=0, O=1). Hosts self-configure addresses via SLAAC; DHCPv6 only hands out DNS and other metadata. The right production default for most LANs.
Stateful DHCPv6 (M=1, O=0 or M=1, O=1). Hosts query DHCPv6 for addresses; SLAAC is not used. The DHCP server is the source of truth for addressing.

Mode 2 (SLAAC + stateless DHCPv6) is the right default for production LANs. Mode 3 (stateful) is the right tool for specific scenarios. Mode 1 (SLAAC only) is acceptable for guest networks or very small deployments but loses central DNS management.

Stateful DHCPv6 — when and how

Stateful DHCPv6 hands out IPv6 addresses from a configured pool. The configuration in OPNsense:

Range: the prefix the firewall will hand out addresses from (e.g. 2001:db8:abcd:e000:: with prefix length 64, range ::100:0 to ::1fff:ffff).
DNS servers: as in DHCPv4.
Domain search list: optional.
RA mode: must be “Managed” (M=1) so hosts query DHCPv6 for addresses instead of using SLAAC.

The RA flags and the DHCPv6 server configuration must be aligned. If M=1 in the RA but the DHCPv6 server is not enabled, hosts receive no addresses. If M=0 in the RA but the DHCPv6 server is enabled, hosts use SLAAC and never query the DHCPv6 server.

When to use stateful DHCPv6:

Servers with stable IPv6 addresses. A server with inbound firewall rules needs a stable IPv6 address; privacy extensions break this. Stateful DHCPv6 with reservations gives stable addresses.
Compliance-driven auditing. The DHCPv6 server logs every lease; the operator can audit “which host had which IPv6 address at which time”. SLAAC produces no audit trail.
Central inventory. All addressing decisions live in the DHCPv6 server; SLAAC is disabled.

For most production LANs, SLAAC + stateless DHCPv6 is simpler. Stateful DHCPv6 is the right tool for the specific scenarios above.

Stateless DHCPv6 — when and how

Stateless DHCPv6 hands out only “other” configuration. The configuration in OPNsense:

Enable: yes.
Range: not used (stateless mode does not hand out addresses).
DNS servers: the addresses the firewall should advertise.
Domain search list: optional.
RA mode: must be “Assisted” or “Stateless DHCPv6” (M=0, O=1) so hosts know to query DHCPv6 for DNS but self-configure addresses via SLAAC.

The stateless DHCPv6 server in OPNsense runs dhcp6s in a mode that responds to Information Request messages with the configured DNS and search list. Hosts that already have a SLAAC address send Information Requests when they receive an RA with O=1.

The benefits of stateless DHCPv6:

Central DNS configuration. The operator changes DNS in one place; all LAN hosts pick up the change on next RA cycle.
Address stability from SLAAC. SLAAC addresses derived from the prefix are stable as long as the prefix does not change. Privacy extensions rotate them, but operators who need stability can disable privacy extensions.
No server-side address tracking. The DHCPv6 server has no address leases to maintain; only DNS configuration. Much simpler than stateful DHCPv6.

Read-only / SafeDHCPv6 information-request— A stateless DHCPv6 exchange. The host sends an information-request (type 11) carrying its DUID-LL and requesting DNS options. The server responds with a reply (type 7) carrying the DNS server and search list. The host already has its address from SLAAC; this exchange only updates DNS configuration.

$ tcpdump -nei igb1 -vvv port 547

12:34:56.789012 aa:bb:cc:11:22:33 > ff02::1:2: DHCPv6, length 102
12:34:56.789012   message-type 11 (information-request)
12:34:56.789012   transaction-id 0x12345
12:34:56.789012   client-id option 1, length 14
12:34:56.789012     DUID-LL: link-layer address 2
12:34:56.789012       link-layer address: aa:bb:cc:11:22:33
12:34:56.789012   option-request option 6, length 4: DNS recursive name server, DNS domain search list
12:34:56.789020 2001:db8:abcd:e000::1 > aa:bb:cc:11:22:33: DHCPv6, length 142
12:34:56.789020   message-type 7 (reply)
12:34:56.789020   DNS recursive name server option 23, length 16: 2001:db8:abcd:e000::1
12:34:56.789020   DNS domain search list option 24, length 12: lan.example.com

Illustrative output

The RA flag alignment

The M and O flags in the Router Advertisement must match the DHCPv6 server mode:

RA mode	M flag	O flag	Stateful DHCPv6 server	Stateless DHCPv6 server
Unmanaged	0	0	Not used	Not used
Assisted / Stateless	0	1	Not used	Required
Managed	1	0	Required (addresses)	Optional (DNS)
Managed + Assisted	1	1	Required (addresses)	Required (DNS)

The operator picks the RA mode based on the desired behaviour, then ensures the DHCPv6 server matches:

Unmanaged: no DHCPv6 server needed.
Assisted / Stateless: stateless DHCPv6 server with DNS configured.
Managed: stateful DHCPv6 server with a pool.
Managed + Assisted: both servers, with stateful for addresses and stateless for DNS.

The configurations are independent but coordinated. The OPNsense GUI exposes them under separate sections (Services → Router Advertisements → [LAN] for RA, Services → DHCPv6 → [LAN] for the server).

DHCPv6 reservations

Like DHCPv4, DHCPv6 supports reservations — fixed IPv6 addresses tied to a DUID (DHCP Unique Identifier). The configuration is under the DHCPv6 service.

The DUID is captured from the host’s first DHCPv6 exchange (the client-id option). The operator copies the DUID into the reservation in OPNsense, sets the IPv6 address, and applies.

For stateful DHCPv6 with reservations:

The host requests a lease.
The server sees the DUID, finds the reservation, returns the reserved address.
The host uses the reserved address.

The reservation discipline for IPv6 is the same as for IPv4: central inventory, regular review, remove reservations for decommissioned hosts.

How the DUID differs from MAC

The DUID (DHCP Unique Identifier) is a stable identifier for a DHCPv6 client. The most common format is DUID-LL (link-layer), which encodes the host’s MAC address:

00:01:00:01:aa:bb:cc:11:22:33
^^ ^^   ^^   ^^^^^^^^^^^^^^^^
|  |    |   |
|  |    |   MAC address (link-layer address)
|  |    type (1 = link-layer)
|  hardware type (1 = Ethernet)
DUID type (1 = LL)

The first 4 bytes are fixed (type 1, hardware 1, type 1 again for link-layer); the remaining bytes are the MAC address.

DUID is stable across reboots on most platforms — it is computed once and stored. Unlike MAC, it does not change when a virtualisation platform randomises the MAC (because the host computes the DUID-LL from whatever MAC it has at install time, and uses that DUID thereafter).

The implication: an operator who changes the host’s MAC (perhaps to fix a privacy issue) does not necessarily change the host’s DUID. Reservations tied to DUID survive MAC changes; reservations tied to MAC (in DHCPv4) do not.

Common DHCPv6 mode failure modes

Five failure modes appear repeatedly:

RA flag mismatch. RA says M=1 but DHCPv6 server is not enabled (or vice versa). Hosts get no address or do not query DHCPv6. Fix: align RA mode and DHCPv6 server configuration.
Range outside the LAN prefix. The DHCPv6 range uses a prefix that does not match the interface’s IPv6 address. Clients get addresses that are not routable on the LAN. Fix: align the range prefix with the interface address.
DUID mismatch on reservations. The reservation uses a DUID that does not match the host’s actual DUID. The host gets a pool address instead of the reserved one. Fix: capture the DUID from the first exchange and update the reservation.
Firewall blocking DHCPv6. IPv6 firewall rules must permit UDP 546/547 between LAN hosts and the firewall. Custom rules may not include this. Fix: add permit rules for DHCPv6.
Stateless DHCPv6 with M=1. RA says M=1 but the operator wanted SLAAC + stateless DHCPv6. Hosts query stateful DHCPv6 instead of using SLAAC. Fix: change RA mode to “Assisted” (M=0, O=1).

Summary

Stateful DHCPv6 hands out IPv6 addresses; stateless DHCPv6 hands out only DNS and metadata.
SLAAC + stateless DHCPv6 (M=0, O=1) is the right production default for most LANs.
Stateful DHCPv6 is reserved for stable address requirements, compliance auditing, and central inventory.
The RA flags and the DHCPv6 server configuration must be aligned — M=1 requires stateful DHCPv6, O=1 requires stateless DHCPv6.
DHCPv6 reservations use DUID, not MAC, as the key. Capture the DUID from the first exchange.