Hey did you ever figure this out? Seeing something very similar on Comcast/Xfinity. Getting assigned a IPv6 address on the WAN interface that I can ping from OPNsense itself, but that I can't ping from anywhere else on the Internet despite having appropriately-permissive firewall rules.