IPv6 on the interface

IPv6 is not optional on a modern OPNsense firewall. Most ISPs hand out an IPv6 prefix via DHCPv6-PD, and most client devices expect IPv6 to work end-to-end. This lesson covers the four IPv6 addressing modes the operator chooses between — static, SLAAC, DHCPv6, and track interface — and the failure modes that surface when IPv6 is misconfigured.

The four modes

For OPNsense on the WAN side, the typical setup is “track interface” (the WAN interface follows the upstream DHCPv6-PD prefix), and the LAN interfaces also use “track interface” to derive their IPv6 addresses from the WAN’s prefix. The operator rarely needs to configure a static IPv6 address on a client interface.

$ ifconfig igb1 | grep -E 'inet6|prefix'

inet6 fe80::a65e:60ff:fedd:eeff%igb1 prefixlen 64 scopeid 0x2
inet6 2001:db8:1234:5600::1 prefixlen 64
inet6 2001:db8:abcd:ef00::1 prefixlen 64 autoconf

Static IPv6

A static IPv6 configuration is identical in concept to static IPv4: the operator enters the address and prefix length. Typical use cases:

• Servers that need a stable address for DNS records.
• The firewall’s own LAN-side address when the operator wants a predictable gateway address (often the first or last address in the /64 prefix).
• Loopback or management addresses.

The configuration takes:

• IPv6 address: e.g. 2001:db8:1234:5600::1.
• Prefix length: typically /64 for a normal subnet.
• Upstream gateway (WAN only): the ISP’s IPv6 gateway address.

OPNsense exposes this under Interfaces → [name] → IPv6 Configuration Type: Static IPv6.

SLAAC (Stateless Address Autoconfiguration)

SLAAC is the IPv6 mechanism by which a host configures its own address. The host listens for router advertisements (RAs) on the local link; each RA includes a prefix (e.g. 2001:db8:abcd::/64) and a flag indicating whether to use SLAAC for that prefix. The host then combines the prefix with its own interface identifier (typically derived from the MAC address via EUI-64) to form a complete address.

SLAAC is the default mode for most LAN-side hosts. The OPNsense firewall can be configured to send RAs on its LAN interfaces (acting as the IPv6 router for that segment); clients then configure their own addresses via SLAAC.

For OPNsense on a LAN interface, the operator enables the “Router Advertisements” service under Services → Router Advertisements → [LAN]. OPNsense sends RAs on the interface with the configured prefix, and clients self-configure.

DHCPv6 and DHCPv6-PD

DHCPv6 is the stateful counterpart to SLAAC: a DHCPv6 server hands out IPv6 addresses and configuration to clients that request them. DHCPv6-PD (Prefix Delegation) is a related mechanism by which an ISP hands out a prefix (e.g. a /56) to the customer, who then subdivides it (typically into /64s) for internal networks.

The typical ISP flow:

1. The firewall’s WAN interface runs a DHCPv6 client (dhcp6c).
2. The client requests a delegated prefix (IA_PD option).
3. The ISP’s DHCPv6 server responds with a /56 or /48 prefix.
4. The firewall tracks the upstream prefix and uses parts of it for downstream interfaces (the “track interface” mode below).

OPNsense exposes the WAN DHCPv6 client under Interfaces → [WAN] → IPv6 Configuration Type: DHCPv6. The operator configures:

• Request a prefix delegation: yes (default for most ISPs).
• Prefix delegation size: what the ISP offers (typically /56 or /48; the operator cannot change this — it is the ISP’s policy).
• Send a hint: hint the IA_PD to a specific value (rare).

Track interface

The most common production setup for an OPNsense firewall with IPv6:

• WAN interface: DHCPv6 client, requesting a delegated prefix.
• LAN interfaces: track interface, configured with a /64 derived from the WAN’s delegated prefix.

“Track interface” tells the LAN interface: “your IPv6 address is <WAN delegated prefix>::1 or similar; the gateway is the upstream interface’s link-local address; everything else follows the upstream prefix’s lifetime”. When the upstream prefix changes (e.g. ISP rotates the delegation), the LAN prefix follows automatically.

Configuring track interface

Interfaces → [LAN] → IPv6 Configuration Type: Track Interface. The fields:

• Track IPv6 interface: the upstream interface (typically WAN).
• IPv6 prefix ID: the sub-prefix within the delegated prefix. For a /56 delegation and a /64 LAN, this is the low byte of the sub-prefix. Default 0.

After applying, the LAN interface has an IPv6 address derived from the WAN’s delegated prefix. Clients on the LAN receive RAs with the LAN prefix and self-configure via SLAAC.

$ rtsol -d igb0

igb0: status: active, link-layer address: a4:5e:60:dd:ee:ff
igb0: RA received: 2001:db8:abcd:e000::/64, router lifetime 1800s
igb0: RA flags: managed (M), other (O)
igb0: MTU: 1500
igb0: reachable time: 30000ms
igb0: retransmit timer: 1000ms

Common IPv6 failure modes

Three failure modes show up repeatedly:

1. No router advertisements on the LAN. The firewall has no radvd running on the LAN interface. Clients get link- local only and cannot reach external IPv6. Fix: enable Router Advertisements under Services → Router Advertisements → [LAN].

2. Delegated prefix not received on WAN. The firewall’s DHCPv6 client cannot reach the upstream server, or the server does not delegate a prefix. Check ifconfig <WAN> for an IPv6 address from the delegated prefix range; check /var/db/dhcp6c_<iface>.lua for the lease state.

3. Privacy extensions break inbound rules. A host on the LAN uses a different SLAAC address every day. Firewall rules that match the host’s address fail intermittently. Fix: disable privacy extensions on the host, or use DHCPv6 with stable assignments, or write rules against the host’s full /64.

Production patterns

Three patterns cover most cases:

1. ISP hands out DHCPv6-PD: WAN is DHCPv6 client; LANs are track interface. Standard consumer/SMB setup.
2. Static IPv6 from ISP: WAN is static IPv6; LANs are either track interface (if the operator wants to subdivide) or static with manually chosen prefixes.
3. IPv6 disabled entirely: the operator’s network does not need IPv6. Disable IPv6 on every interface to avoid accidentally exposing IPv6 services.

Summary

• Four modes: static, SLAAC, DHCPv6, track interface.
• WAN typically runs DHCPv6 client with prefix delegation.
• LAN typically runs track interface with the prefix derived from the WAN delegation.
• Router Advertisements on the LAN are how clients learn the prefix and self-configure via SLAAC.
• Privacy extensions break inbound rules; consider DHCPv6 for stable assignments in production.