SLAAC and Router Advertisements — how OPNsense announces the IPv6 prefix · OPNsense

IPv6 hosts self-configure their addresses by listening to Router Advertisements sent by the local router. The advertisement carries a prefix; the host combines the prefix with its own interface identifier to form a complete address. This mechanism is called SLAAC (Stateless Address Autoconfiguration), and it is the dominant IPv6 host-configuration model on most production networks.

The firewall operator’s role is to make OPNsense the source of Router Advertisements for every LAN interface, with the right flags to tell hosts how to interpret them. Misconfigured RAs are the most common cause of “IPv6 does not work on the LAN” — and the fix is in the RA service, not the DHCP service.

How SLAAC builds an address

The IPv6 address has 128 bits. SLAAC divides that into:

The prefix (the first 64 bits). The router tells the host what the prefix is in the Router Advertisement.
The interface identifier (the last 64 bits). The host builds this from its own MAC address (EUI-64 format) or, with privacy extensions, from a random value.

A host with MAC aa:bb:cc:11:22:33 and prefix 2001:db8:abcd:e000::/64 ends up with address 2001:db8:abcd:e000:a8bb:ccff:fe11:2233. The transformation:

aa:bb:cc:11:22:33 (MAC, 48 bits)
  ↓ split, insert ff:fe, flip the U/L bit
a8:bb:cc:ff:fe:11:22:33 (interface identifier, 64 bits)
  ↓ prepend the prefix
2001:db8:abcd:e000:a8bb:ccff:fe11:2233 (full address)

The host then performs duplicate-address detection (DAD) by sending a Neighbor Solicitation for the address it just built. If no Neighbor Advertisement arrives, the host assumes the address is unique and assigns it to the interface.

How Router Advertisements work

A Router Advertisement (RA) is an ICMPv6 message sent periodically (typically every 200 seconds) by a router to the all-nodes multicast group ff02::1. Every IPv6 host on the segment receives it.

An RA carries:

Field	Purpose
Source address	The router’s link-local address
Destination	`ff02::1` (all nodes)
Router Lifetime	How long the host should consider this router as a default gateway
Prefix Information option	One or more prefixes the host may use, with lifetimes
Flags	M (Managed), O (Other), Prf (Preference)
MTU	The link MTU the host should use
Recursive DNS Server (RDNSS)	Optional DNS server option

The host listens to RAs continuously and uses the most recently received one. If the RA changes (e.g. the prefix changes), the host re-configures.

Read-only / Safertsol output— rtsol sends a Router Solicitation and prints the received RA. The prefix is 2001:db8:abcd:e000::/64; the M and O flags are set; the RDNSS option carries the firewall as the DNS server. Hosts on this segment will self-configure via SLAAC for their address and use DHCPv6 for DNS.

$ rtsol -d igb0

igb0: status: active, link-layer address: a4:5e:60:dd:ee:ff
igb0: RA received: 2001:db8:abcd:e000::/64, router lifetime 1800s
igb0: RA flags: managed (M), other (O)
igb0: MTU: 1500
igb0: reachable time: 30000ms
igb0: retransmit timer: 1000ms
igb0: RDNSS: 2001:db8:abcd:e000::1, lifetime 600s

Illustrative output

The M and O flags

The two flags that determine how hosts interpret the RA:

M (Managed Address Configuration). When set, hosts use DHCPv6 to obtain their address (stateful DHCPv6). When clear, hosts self-configure via SLAAC.
O (Other Configuration). When set, hosts use DHCPv6 to obtain other configuration (DNS, NTP, search domains). When clear, hosts do not query DHCPv6 for anything.

The combinations:

M	O	Hosts do
0	0	SLAAC for address, no DHCPv6 at all
0	1	SLAAC for address, DHCPv6 only for DNS and other config
1	0	Stateful DHCPv6 for address, no other DHCPv6
1	1	Stateful DHCPv6 for address and other config

For most production networks, M=0, O=1 is the right combination. Hosts get addresses via SLAAC (no need to maintain DHCPv6 leases for every host) but pick up DNS from DHCPv6 (so the operator can centralise DNS settings). When SLAAC is acceptable and the operator wants zero DHCPv6, M=0, O=0 works; the host uses its SLAAC address and whatever DNS it has manually configured.

OPNsense as the RA source

For OPNsense to send RAs on a LAN interface:

The interface must have an IPv6 address in the prefix the RA advertises. This is typically a “track interface” configuration that derives the LAN address from the upstream DHCPv6-PD delegation.
The Router Advertisements service must be enabled under Services → Router Advertisements → [LAN].
The RA mode determines the M and O flags. The default is “Unmanaged” (M=0, O=0). For M=0, O=1, choose “Assisted” or “Stateless DHCPv6”. For M=1, O=0/1, choose “Managed”.

The configuration page exposes:

Router Advertisements: enabled/disabled
RA mode: unmanaged / managed / assisted / stateless
Advertise default gateway: yes (almost always)
Advertised prefixes: the prefix to advertise (typically interface-IPv6-prefix::/64 for track-interface configurations)
DNS options: optional RDNSS in the RA itself (bypasses DHCPv6 for DNS)
Minimum / maximum interval: how often RAs are sent

After applying, the firewall sends RAs on the LAN interface. Hosts pick up the prefix and self-configure.

Capturing an RA on the wire

The fastest way to verify RAs are flowing is a packet capture:

Read-only / Safetcpdump icmp6 ra— A captured Router Advertisement on the LAN interface. The source is the firewall's link-local; the destination is the all-nodes multicast. The ICMPv6 type 134 is 'router advertisement'. The prefix information option carries the LAN prefix with lifetimes. The 'pref 14400s' field is the preferred lifetime; addresses older than preferred are deprecated but still usable for existing connections.

$ tcpdump -nei igb1 icmp6 and 'ip6[40]==134'

12:34:56.789012 fe80::a65e:60ff:fedd:eeff > ff02::1, ICMP6, router advertisement, length 96
12:34:56.789012   0x0000:  fe80 0000 0000 0000 a65e 60ff fedd eeff
12:34:56.789012   0x0010:  ff02 0000 0000 0000 0000 0000 0000 0001
12:34:56.789012   0x0020:  8600 6edc 4000 0e00 0000 0000 0000 0000
12:34:56.789012   prefix: 2001:db8:abcd:e000::/64 [valid 86400s] [pref 14400s]

Illustrative output

The ip6[40]==134 BPF filter matches ICMPv6 type 134 (router advertisement). If the capture is empty, RAs are not being sent.

What radvd does on OPNsense

OPNsense’s Router Advertisements service is a configuration wrapper around the FreeBSD port of radvd (the Router Advertisement Daemon). When the operator enables the service on a LAN interface and configures the prefixes, OPNsense writes a radvd.conf snippet and starts the daemon. The daemon binds to the interface’s link-local address and sends RAs every 200 seconds (configurable).

If the interface is a “track interface” (its IPv6 address is derived from the upstream DHCPv6-PD), OPNsense watches the upstream prefix and regenerates the radvd.conf when the prefix changes. This is the mechanism by which RAs follow the upstream rotation.

The RA flags in the configuration translate directly to the M and O bits in the ICMPv6 message. The “RA mode” presets in the GUI set both flags together; the operator who needs finer control can edit the radvd configuration directly via diagnostics.

Common RA failure modes

Four failure modes appear repeatedly in production:

No RA service on the LAN. The firewall has an IPv6 address but is not sending RAs. Clients get link-local only (fe80::...) and cannot reach external IPv6. Fix: enable Services → Router Advertisements → [LAN].
Wrong prefix advertised. The RA carries a prefix the LAN is not actually on, or carries the wrong prefix length. Clients configure addresses that are not routable. Fix: verify the prefix matches the interface’s IPv6 address prefix and is /64.
M flag set without a working DHCPv6 server. Clients try to obtain addresses via DHCPv6; the DHCPv6 server is unreachable; clients have no address. Fix: change the RA mode to “Unmanaged” or “Assisted” (M=0).
RA service running but no clients responding. The RAs are arriving; clients are not picking them up. Rare, but possible if the host has the IPv6 protocol disabled, the link-layer is misconfigured, or the host’s privacy extensions are interfering with the SLAAC flow.

Summary

SLAAC builds host addresses from a prefix (advertised in RAs) and an interface identifier (from MAC or random).
Router Advertisements carry prefix information, lifetimes, and the M/O flags that control DHCPv6 use.
For most production LANs, M=0, O=1 (Assisted mode) is the right combination: SLAAC for addresses, DHCPv6 for DNS only.
OPNsense sends RAs via the radvd service under Services → Router Advertisements → [LAN].
Verify with rtsol -d and tcpdump -nei <iface> icmp6 and 'ip6[40]==134'.
Privacy extensions break inbound rules; disable or use DHCPv6 for stable addresses.