I'm attempting to stand up a dual stack deployment and I can't get IPv6 working. While I'm familiar with OPNsense and IPv4, this is my first real foray into the world of IPv6.
ISP Router --> OPNsense --> Client
I'm stuck with the ISP router and it has zero configuration options. OPNsense is an up to date install and reset to defaults. It receives an IPv6 address from the ISP router and can connect to IPv6 hosts. The client is unable to connect to anything IPv6. If I connect the client directly to the ISP router then IPv6 just works.
How do I get IPv6 working on LAN?
Your ISP router should offer something the like of IPv6 prefix delegation (IA_PD).
It has to delegate a prefix via DHCPv6 that the OPNsense can use. The WAN interface would be configured with DHCPv6, and internal networks like LAN with Identity Association mode.
Then you need a Router Advertisement Daemon like Dnsmasq or Radvd to offer the prefixes (/64) that were subnetted from the delegated ISP prefix (>/64) to internal clients.
-------
If (and only if) your ISP router has no prefix delegation mode, a workaround could be an NDP proxy.
https://docs.opnsense.org/manual/ndp-proxy-go.html
Quote from: Monviech (Cedrik) on May 25, 2026, 02:42:07 PMYour ISP router should offer something the like of IPv6 prefix delegation (IA_PD).
Unfortunately, it really does have zero configuration options. I can't even change the IPv4 subnet.
Quote from: Monviech (Cedrik) on May 25, 2026, 02:42:07 PMIt has to delegate a prefix via DHCPv6 that the OPNsense can use. The WAN interface would be configured with DHCPv6, and internal networks like LAN with Identity Association mode.
Then you need a Router Advertisement Daemon like Dnsmasq or Radvd to offer the prefixes (/64) that were subnetted from the delegated ISP prefix (>/64) to internal clients.
From what I can tell, that is how the OPNsense defaults are configured for IPv6. I wasn't able to get it to work, I assume because I'm not getting a prefix from the ISP.
Quote from: Monviech (Cedrik) on May 25, 2026, 02:42:07 PMIf (and only if) your ISP router has no prefix delegation mode, a workaround could be an NDP proxy.
https://docs.opnsense.org/manual/ndp-proxy-go.html
How would I configure the interfaces?
From what I read online, it appeared that IPv6 NAT was my only solution. How does the proxy compare to that?
Check /tmp if you find a file that contains "prefix" for you WAN interface.
(eg igb1_prefix6...) out of my head right now.
Quote from: Monviech (Cedrik) on May 25, 2026, 02:50:07 PMCheck /tmp if you find a file that contains "prefix" for you WAN interface.
(eg igb1_prefix6...) out of my head right now.
I'll take a look. Do the WAN IPv6 defaults need to be changed in order for this to show?
On WAN you need DHCPv6 configured in order for that file to show.
For the ndp proxy, it has an example configuration to follow inside the manual. If you configure it exactly like that, IPv6 will most likely "just work" without any NAT66.
Quote from: Monviech (Cedrik) on May 25, 2026, 03:07:23 PMOn WAN you need DHCPv6 configured in order for that file to show.
For the ndp proxy, it has an example configuration to follow inside the manual. If you configure it exactly like that, IPv6 will most likely "just work" without any NAT66.
I'll give that a try. There does seem to be some typos/errors in the manual. There's no or option to the either clause.
Go to Interfaces ‣ LAN and choose either a link-local IPv6 configuration.
Thanks I will fix that, looks like a grammar error.
Quote from: Monviech (Cedrik) on May 25, 2026, 02:50:07 PMCheck /tmp if you find a file that contains "prefix" for you WAN interface.
(eg igb1_prefix6...) out of my head right now.
I reset to defaults and confirmed that my WAN was set to DHCPv6. I don't see anything prefix in /tmp.
If there is no prefix you have these choices:
- Configure your ISP router to provide a prefix via DHCPv6
- Use the ndp proxy without a prefix via SLAAC
- Use NAT66 with ULAs or a "stolen" "internal" GUA
- Don't use IPv6
I installed the ndp-proxy-go plugin and configured it according to the manual. I unchecked RA under Dnsmasq General.
My client now get global and unique local addresses that match the WAN prefix. Client default route now shows LAN IPv4 and IPv6. Client DNS shows WAN gateway for IPv6 and OPNsense for IPv4.
I still have no IPv6 connectivity on the client. All pings timeout. Looking at the Firewall Live View I see the client global address being blocked by the default deny rule despite the default LAN allow all rules.
What does your allow all rule for IPv6 on LAN look like exactly? If you have source = LAN net instead of source = any, and you are using the NDP proxy, that would explain the traffic being denied because there is no LAN net. The firewall doesn't have an IPv6 address in that single /64 you use with the proxy on LAN (!).
Quote from: Patrick M. Hausen on May 25, 2026, 05:53:53 PMWhat does your allow all rule for IPv6 on LAN look like exactly? If you have source = LAN net instead of source = any, and you are using the NDP proxy, that would explain the traffic being denied because there is no LAN net. The firewall doesn't have an IPv6 address in that single /64 you use with the proxy on LAN (!).
I'm speaking of the default rules that are configured on install. I have not made any modifications. The manual implies it should just work.
Please show the rule. They are matched for static or "track interface" configuration, not for NDP proxy. I don't have a firewall with the defaults still active so I cannot look.
Quote from: Patrick M. Hausen on May 25, 2026, 06:41:19 PMPlease show the rule. They are matched for static or "track interface" configuration, not for NDP proxy. I don't have a firewall with the defaults still active so I cannot look.
The default LAN allow rule is source = LAN net. I added the ndp proxy alias and rule settings from the manual but they don't appear to be getting populated.
Change LAN net to any just for a test and try again, please.
Quote from: Patrick M. Hausen on May 25, 2026, 06:54:55 PMChange LAN net to any just for a test and try again, please.
That does work. test-ipv6.com now shows the client global IPv6.
ETA: The ndp alias are now populated as well.
See? Then please show all your rules and aliases you tried and @Monviech will probably be able to help with the details. I have no experience with the NDP proxy in production but the fact that LAN net would not work is obvious from basic principles.
Quote from: Patrick M. Hausen on May 25, 2026, 07:07:48 PMSee? Then please show all your rules and aliases you tried and @Monviech will probably be able to help with the details. I have no experience with the NDP proxy in production but the fact that LAN net would not work is obvious from basic principles.
I wasn't arguing with you, just providing what the manual said.
Do you run any multi-WAN IPv6? That's my next hurdle for dual stack.
For anybody else reading this, the proxy only populates aliases when certain events happen, mostly DAD probes and NDP probes of clients.
This means when the proxy is already started and aliases are (manually) added afterwards, most clients will already be learned. That means the alias population events already went by before the aliases existed the first time.
That heals itself, but it takes a bit on initial deployment.
And yes, obviously (I hope) LAN_network alias will not contain any proxied IPv6 networks.
Quote from: Monviech (Cedrik) on May 25, 2026, 07:43:47 PMAnd yes, obviously (I hope) LAN_network alias will not contain any proxied IPv6 networks.
So what's your recommendation? Use "WAN net" instead as source on all internal networks served by the proxy? Or "any"?
I assume WAN network won't contain the on link prefix (I didnt check, only an assumption). I would just use any as source, or the alias that the proxy populates.
In my home network where I use the proxy I use the proxy populated alias, didnt notice any issues since months, so I assume in most standard setups it will work correctly.
Quote from: Monviech (Cedrik) on May 25, 2026, 09:44:42 PMI would just use any as source, or the alias that the proxy populates.
Now I understand - the proxy populates an alias automatically which can then be used in firewall rules. So @CJ missed to change the rule from "LAN net" to that alias.
Thanks!
Yes, but the alias that the proxy populates can be a bit delayed during first setup. So it can look like there is no IPv6 for a minute or so.
The issue is the initial workflow.
If you first set up the proxy, it immediately learns all clients and fires all events.
If you then create aliases afterwards, and apply the configuration again, it will not immediately relearn all clients (since it already did learn them). It would only do that if the cache file is enabled, otherwise it is truly stateless (meaning clients would need to send ndp packets first before they get discovered again)