Messages

I believe it is due to the virtual IP, and perhaps some of the RA bits. After commenting out the blocking bits and looking at what is written to the config I saw that it was configuring for the public v6 range and not the ULA range, while displaying the ULA range in the interface...

I've filed an issue on github.

https://github.com/opnsense/core/issues/2189

There are 2 things that can help with NAT traversal.
The first is UPNP, as you've already done.
The second one is especially helpfull for a lot of games: static port NAT for UDP. It will allow another hole punching technique to work. You can either set it up for your entire network, or just for your PS4's
Go to Firewall->NAT->Outbound. Switch your configuration to Hybrid and hit save.
Then make a new rule with the following:
Protocol -> UDP
Source adress -> enter IP of PS4 here or enter network including netmask to apply to entire network
Static-Port -> checkmark.

Repeat for adresses of other PS4's if you're applying solely to those and see if NAT situation has improved.

Some information about my setup:
-i have 4 physical interfaces
-my wan interface is a pppoe connection running over a tagged vlan on one of my physical interfaces
--i have a public ipv4 adress and another ipv4/29 subnet
--i also have a /48 public ipv6 prefix, delivered via dhcp6-pd

my internal interfaces are a mix of vlans and physical interfaces, some bridged some not All of them are:
-configured with an ipv4 adress in private space via Interfaces->Name static ipv4
-configured with an IPv6 ULA  adress via same interface
-configured with an IPv6 publicly routable adress via virtual IP configuration.

On interfaces which need autoconfiguration DHCPv4 is set up as well as RA
RA advertises 2 routes, both with a prefix length of 64:
-the publicly routable adress
-the ULA
RA is configured to do assisted RA, the intention is to allow SLAAC for public adressing, while registering ULA in the DHCPv6 server.

However no matter what I enter I cannot get DHCPv6 configured with a range, all adresses I enter are rejected saying they are out of range: see attached picture.


Am I misconfiguring or running into a bug?