DHCPv6 on OPNsense — stateful, stateless, and when each is right

SLAAC handles most IPv6 host addressing. So why run DHCPv6 at all? Because DHCPv6 does three things SLAAC cannot: it hands out stable addresses that survive host reboots and identifier rotations, it lets the operator centralise configuration (DNS, NTP, search domains) without per-host setup, and on the upstream side it receives a prefix delegation from the ISP. DHCPv6 on OPNsense plays different roles in three different places, and the configuration differs by role.

This lesson covers the three modes of DHCPv6, how OPNsense implements each, and the operational scenarios that pick one over the others.

DHCPv6 has three jobs

DHCPv6 plays three distinct roles in an IPv6 deployment:

1. DHCPv6-PD on the WAN side: the firewall’s WAN interface runs a DHCPv6 client that requests a prefix delegation (IA_PD) from the ISP. This is how the firewall receives the /48 or /56 it subdivides for its LANs.
2. DHCPv6 server on the LAN side (stateful): the firewall runs a DHCPv6 server that hands out addresses from a configured pool, with stable identity and centralised DNS.
3. DHCPv6 server on the LAN side (stateless): the firewall runs a DHCPv6 server that hands out only “other” configuration (DNS, NTP, search domains). Hosts get addresses via SLAAC and use DHCPv6 only for the metadata.

Most production deployments run SLAAC for LAN addresses (modes 2/3 of the previous lesson) plus DHCPv6-PD on the WAN side (mode 1). The stateful DHCPv6 server on the LAN (mode 2) is reserved for special cases.

DHCPv6 vs DHCPv4 — the protocol difference

DHCPv6 is not an extension of DHCPv4. The same OPNsense service handles both, but the message types, ports, and lease semantics differ.

The DUID is the most consequential difference for operators. A DHCPv6 reservation cannot be tied to a MAC the way a DHCPv4 reservation can; the operator must capture the host’s DUID and use that in the reservation. A DUID is typically derived from a timestamp + MAC (DUID-LL) but can be opaque.

$ tcpdump -nei igb1 -vvv port 547

12:34:56.789012 aa:bb:cc:11:22:33 > 2001:db8:abcd:e000::1: DHCPv6, length 102
12:34:56.789012   message-type 1 (solicit)
12:34:56.789012   transaction-id 0x12345
12:34:56.789012   client-id option 1, length 14
12:34:56.789012     DUID-LL: link-layer address 2
12:34:56.789012       link-layer address: aa:bb:cc:11:22:33
12:34:56.789012   elapsed-time option 8, length 2: 0
12:34:56.789012   option-request option 6, length 4: DNS recursive name server, DNS domain search list
12:34:56.789012   fully-qualified-domain-name option 39, length 0

Configuring the WAN DHCPv6 client (prefix delegation)

The WAN-side DHCPv6 client is configured under Interfaces → [WAN] → IPv6 Configuration Type: DHCPv6. The relevant fields:

• Request a prefix delegation: yes (default for most ISPs).
• Prefix delegation size: what the ISP offers — typically /56 or /48; the operator cannot change this.
• Send a hint: optionally hint a specific IA_PD value. Rare.
• Use IPv4 connectivity: some ISPs require an IPv4 connection to negotiate the IPv6 prefix. OPNsense supports DHCPv4 + DHCPv6 on the same interface.

After applying, the WAN interface receives both an IPv6 address (an IA_NA, in the ISP’s /64) and a delegated prefix (an IA_PD, /56 or /48). The OPNsense config extracts the delegated prefix and writes it to the routing/RA configuration for downstream LAN interfaces.

Verify with:

ifconfig <wan>

Look for an inet6 line with the IA_NA address and a separate entry showing the IA_PD. Also check /var/db/dhcp6c_<iface>.lua for the lease state.

Configuring the LAN DHCPv6 server (stateless)

The LAN-side DHCPv6 server in OPNsense runs under Services → DHCPv6 → [LAN]. For stateless mode (hand out DNS only), the configuration is:

• Enable: yes.
• Range: not used (stateless mode does not hand out addresses).
• DNS servers: the addresses of the DNS servers the firewall should advertise.
• Domain search list: optional.
• RA mode: must be “Assisted” (M=0, O=1) so hosts know to query DHCPv6 for DNS but self-configure addresses via SLAAC.

After applying, hosts on the LAN self-configure their SLAAC addresses and query DHCPv6 for DNS. The firewall responds with the configured DNS addresses.

Configuring the LAN DHCPv6 server (stateful)

For stateful DHCPv6 — the firewall hands out addresses from a configured range — the configuration is:

• Enable: yes.
• Range: the prefix the firewall will hand out addresses from (e.g. 2001:db8:abcd:e000:: with prefix length 64, range ::100:0 to ::1fff:ffff).
• DNS servers: as above.
• Domain search list: optional.
• RA mode: must be “Managed” (M=1) so hosts query DHCPv6 for addresses instead of using SLAAC.

Stateful DHCPv6 is the right tool when:

1. The operator needs stable host addresses. SLAAC + privacy extensions rotates addresses; stateful DHCPv6 with reservations keeps them fixed.
2. The operator needs central inventory. DHCPv6 logs every lease, every reservation, every hostname. SLAAC produces no records.
3. Compliance requires address auditability. Some regulations require knowing which host had which address when. DHCPv6 logs make this easy; SLAAC does not.

When to use stateful DHCPv6

Three concrete scenarios call for stateful DHCPv6:

1. Servers that need stable IPv6 addresses for inbound firewall rules. The operator writes a rule permitting inbound SSH to a specific address; the address must not change. SLAAC + privacy extensions is incompatible with this; stateful DHCPv6 with reservations solves it.
2. Compliance-driven environments. Some regulations require the operator to know which host had which address at which time. DHCPv6 logs (kept on the firewall or shipped to a log server) are the audit trail.
3. Static addressing via central management. Some operators prefer “everything is in DHCP” rather than “servers are static, everything else is SLAAC”. This is a style choice; SLAAC plus static for servers is equally correct.

For most office and home environments, SLAAC is the right default. Stateful DHCPv6 is the right tool for the specific scenarios above.

Common DHCPv6 failure modes

Four failure modes appear repeatedly:

1. DHCPv6 server not enabled on the LAN interface. The RA carries M=1 but no DHCPv6 server is listening. Fix: enable Services → DHCPv6 → [LAN] and verify the RA mode matches.
2. Firewall rule blocking DHCPv6. IPv6 firewall rules must permit UDP 546/547 between LAN hosts and the firewall. The default LAN rule permits this; custom rules may not.
3. Wrong prefix in the range. The DHCPv6 range is configured with a prefix that does not match the interface’s IPv6 address prefix. Hosts get addresses that are not on the LAN. Fix: align the range prefix with the interface address prefix.
4. DUID mismatch on reservations. The reservation references a DUID that does not match the host’s actual DUID. The host gets a random lease instead of the reserved address. Fix: capture the host’s DUID from the first DHCPv6 exchange (tcpdump -nei <lan> port 547 shows the client-id option) and update the reservation.

Summary

• DHCPv6 plays three roles: prefix delegation on WAN (client), stateful server on LAN (rare), and stateless server on LAN (DNS only, frequent).
• Stateless DHCPv6 + SLAAC is the right production default for LAN hosts.
• Stateful DHCPv6 is reserved for stable-address requirements, compliance-driven auditing, and central management style preferences.
• The M flag in the RA and the DHCPv6 server configuration must be aligned — M=1 requires a working DHCPv6 server.
• DHCPv6 uses DUID, not MAC, as the client identifier; reservations must capture the DUID from the host’s first exchange.