IPv6 - struggling to configure for it.

[v81]

Have been running OPNsense for about 8 months.

Very keen to get onboard with IPv6

ISP is Superloop - Australia, Fibre To the Home (IPoE)
I believe they offer /56 or /60 networks.
Hardware is a generic Intel N150 unit with 4 x 2.5GbE interfaces.
LAN on ETH0, WAN on ETH3

OPNsense is at 10.0.10.1/24

Interfaces > WAN is enabled, IPv6 config = DHCPv6

DHCPv6 client configuration... picture attached
You cannot view this attachment.

Have tried variations of Request prefix only and Send prefix hint

Interfaces > LAN is enabled, IPv6 config = Track Interface
Track IPv6 Interface...
Parent interface = WAN
Assign prefix ID = 0
Optional interface ID = blank

Overview picture attached...
You cannot view this attachment.

Also Overview - WAN - Details...
"Dynamic IPv6 prefix received   2401:xxxx:2c11:d300::/56"

Services: ISC DHCPv6: [LAN]...
Enabled
Range 2401:****:2c11:d300::1000 - 2401:****:2c11:d300::2000
Leases = none

From the router shell i can ping-6 opnsense.org

Code Select Expand

root@OPNsense:~ # ping -6 opnsense.org
PING(56=40+8+8 bytes) 2401:****:2c00::11d3 --> 2001:1af8:2050:a001:1::1
16 bytes from 2001:1af8:2050:a001:1::1, icmp_seq=0 hlim=55 time=246.099 ms
16 bytes from 2001:1af8:2050:a001:1::1, icmp_seq=1 hlim=55 time=246.149 ms
16 bytes from 2001:1af8:2050:a001:1::1, icmp_seq=2 hlim=55 time=246.054 ms
^C
--- opnsense.org ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 246.054/246.101/246.149/0.039 ms

Indeed going insane here...
Learned a thing about packet capture, my first time, hope this helps...
The following captured during and after a 'dhclient -r' and 'dhclient' on a Linux Mint notebook.

Code Select Expand

LAN (removed for brevity following lines)
igc0 2025-09-18 (removed for brevity following lines)
18:58:49.805826 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2600:1901:0:38d7::, source address fe80::5a4e:3549:c55f:c81a, length 88

18:58:54.688015 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 86: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, neighbor solicitation, who has fe80::5a4e:3549:c55f:c81a, length 32

18:58:54.762335 80:30:49:a4:ca:c7 00:d0:b4:04:45:94 IPv6, length 78: fe80::5a4e:3549:c55f:c81a > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor advertisement, tgt is fe80::5a4e:3549:c55f:c81a, length 24

18:58:54.857481 80:30:49:a4:ca:c7 00:d0:b4:04:45:94 IPv6, length 86: fe80::5a4e:3549:c55f:c81a > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor solicitation, who has fe80::2d0:b4ff:fe04:4594, length 32

18:58:54.857542 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 78: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, neighbor advertisement, tgt is fe80::2d0:b4ff:fe04:4594, length 24

18:59:01.371127 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.371460 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.376861 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42:400::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.376914 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42:400::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:06.997556 00:d0:b4:04:45:94 33:33:00:00:00:01 IPv6, length 166: fe80::2d0:b4ff:fe04:4594 > ff02::1: ICMP6, router advertisement, length 112

18:59:08.046710 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2600:1901:0:38d7::, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:11.056660 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:802::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.056861 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:803::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.057074 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:800::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.057248 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:801::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.053724 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:802::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.053954 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:803::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.054224 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:800::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.054437 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:801::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:16.067026 00:11:32:41:3e:9b 00:d0:b4:04:45:94 IPv6, length 86: fe80::211:32ff:fe41:3e9b > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor solicitation, who has fe80::2d0:b4ff:fe04:4594, length 32

18:59:16.067150 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 78: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, neighbor advertisement, tgt is fe80::2d0:b4ff:fe04:4594, length 24

18:59:16.330020 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 86: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, neighbor solicitation, who has fe80::211:32ff:fe41:3e9b, length 32

18:59:16.330156 00:11:32:41:3e:9b 00:d0:b4:04:45:94 IPv6, length 78: fe80::211:32ff:fe41:3e9b > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor advertisement, tgt is fe80::211:32ff:fe41:3e9b, length 24

18:58:49.805826 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2600:1901:0:38d7::, source address fe80::5a4e:3549:c55f:c81a, length 88

18:58:54.688015 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 86: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, neighbor solicitation, who has fe80::5a4e:3549:c55f:c81a, length 32

18:58:54.762335 80:30:49:a4:ca:c7 00:d0:b4:04:45:94 IPv6, length 78: fe80::5a4e:3549:c55f:c81a > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor advertisement, tgt is fe80::5a4e:3549:c55f:c81a, length 24

18:58:54.857481 80:30:49:a4:ca:c7 00:d0:b4:04:45:94 IPv6, length 86: fe80::5a4e:3549:c55f:c81a > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor solicitation, who has fe80::2d0:b4ff:fe04:4594, length 32

18:58:54.857542 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 78: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, neighbor advertisement, tgt is fe80::2d0:b4ff:fe04:4594, length 24

18:59:01.371127 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.371460 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.376861 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42:400::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:01.376914 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2a04:4e42:400::347, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:06.997556 00:d0:b4:04:45:94 33:33:00:00:00:01 IPv6, length 166: fe80::2d0:b4ff:fe04:4594 > ff02::1: ICMP6, router advertisement, length 112

18:59:08.046710 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2600:1901:0:38d7::, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:11.056660 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:802::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.056861 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:803::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.057074 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:800::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:11.057248 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:801::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.053724 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:802::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.053954 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:803::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.054224 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:800::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:13.054437 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, destination unreachable, beyond scope 2404:6800:4015:801::200a, source address fe80::211:32ff:fe41:3e9b, length 88

18:59:16.067026 00:11:32:41:3e:9b 00:d0:b4:04:45:94 IPv6, length 86: fe80::211:32ff:fe41:3e9b > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor solicitation, who has fe80::2d0:b4ff:fe04:4594, length 32

18:59:16.067150 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 78: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, neighbor advertisement, tgt is fe80::2d0:b4ff:fe04:4594, length 24

18:59:16.330020 00:d0:b4:04:45:94 00:11:32:41:3e:9b IPv6, length 86: fe80::2d0:b4ff:fe04:4594 > fe80::211:32ff:fe41:3e9b: ICMP6, neighbor solicitation, who has fe80::211:32ff:fe41:3e9b, length 32

18:59:16.330156 00:11:32:41:3e:9b 00:d0:b4:04:45:94 IPv6, length 78: fe80::211:32ff:fe41:3e9b > fe80::2d0:b4ff:fe04:4594: ICMP6, neighbor advertisement, tgt is fe80::211:32ff:fe41:3e9b, length 24

18:59:30.751565 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240

18:59:30.751599 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240

18:59:30.800983 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:30.854475 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240

18:59:30.751565 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240

18:59:30.751599 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240

18:59:30.800983 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 142: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 88

18:59:30.854475 00:d0:b4:04:45:94 80:30:49:a4:ca:c7 IPv6, length 1294: fe80::2d0:b4ff:fe04:4594 > fe80::5a4e:3549:c55f:c81a: ICMP6, destination unreachable, beyond scope 2606:4700:3035::ac43:91e7, source address fe80::5a4e:3549:c55f:c81a, length 1240
For a moment yesterday i thought i almost had it..
An ipconfig on girlfriends laptop showed an ipv6 address, ran a ping -6 google.com
Got a timeout, a reply and then 2 more timeouts.


On the same internet connection i have tried a GL.iNet Beryl router, enabled IPv6 and it worked right away.

I'm open to wiping / re-configuring the opnsense unit, but i do have a detailed AdGuard home config in it that i don't want to lose.
Aside from taking an image, I'm not sure i can back this up. Still a way to learn with this.
May virtualise it next time around, but I'm vaguely in the school of a router should be on bare metal.

I hope I've included enough detail.
Any assistance greatly appreciated.

[meyergru]

1. Learn to discriminate between IA_NA (that is the /128 IPv6 your WAN can be assigned - in your case, it is) and IA_PD (that is the /56 prefix that gets delegated to your LAN(s) as /64 with a selectable 8-bit prefix ID).

2. You can actually use the IA_PD for your WAN as well by using a prefix ID that is different from all LAN prefix IDs by selecting "use prefix only" on the WAN IPv6 configuration.

3. I would refrain from using DHCPv6 on LAN and use SLAAC instead.

All of this is explained here. Remember: Try to use the tutorial section as often as possible - it has some very valuable information.

[v81]

I can't say i understand much of what you're saying.

I'm trying hard, really, but after a week of reading a significant amount of material I'm out of gas.

I think i can understand IA_NA(searched, got IANA, but i don't think you mean this) is like a public IPv6 address, and IA_PD (PD= prefix delegation?)
Ok, so how do i discriminate, what am i missing? Are you saying i have something configured wrong? Can you be more specific?

I have attempted to read the material you linked, but I'm just not grasping it.
Acronyms that have no meaning to me and slashes all over the place.. i get they're subnets.. but i barely know what a subnet is

I was really hoping for a checkbox called auto.. but clearly there isn't one.

I'm pushing against the edge of my ability and understanding here.
I came from a reddit post saying it was crazy how so many people were still not using IPv6 and that it's easier than IPv4 to configure.
I'd kick that dude in the ass if i could, they're clearly factually incorrect.
I can configure IPv4, maybe not terribly well, but i can do it. IPv6, after spending 2-6 hours a day on this for a week.. nothing.
I've learned to capture packets, have learned many other tricks.. but i just want damn IPv6.

I've looked at the tutorial you've described... followed it.. nothing.
I'm clearly missing something, I'd love for someone to actually take me through some REAL diagnostic steps. - reason i did the capture.

Really not trying come off as a prick, but Is there anyone that can actually help, instead of pointing to tutorials/guides that don't work for me.
Because... i have tried them, many of them. And now i have nothing left to try.

[Patrick M. Hausen]

Your WAN interface looks good. You have a prefix of length /56 delegated - that means you can run up to 256 internal interfaces. You should put 56 instead of 60 in the WAN configuration.

Disable DHCPv6 on LAN - it's not necessary.

Now your LAN needs an IPv6 address. Did you configure that as "track interface" with WAN as the one to track? It looks like you did because it does have an address.

Now all you need to do is

- enable router advertisements on LAN
- add a firewall rule on LAN permitting IPv6 if not already present

[meyergru]

First off, OpnSense ist not your average consumer appliance that "just works" - but you have discovered that already. It is a professional tool with many bells and whistles. Alas, some knobs have to be turned to achieve the desired results.

Second off, networking is hard and not for the faint of heart.

To make it somewhat easier, there are HOWTOs in the tutorial section (some of which I wrote). Alas, and I also do not want to sound condescending, but if you cannot follow those, you may really be pushing on the edge of your ability.

If you have specific questions, we can answer them here, but it is very hard to lead you to an installation that has undergone "many tutorials" already (and mixing them). I understand the impulse to follow Youtube tutorials that give the impression that this is "all easy" and more often than not, are outdated and made by people who want the clicks and do not have deep OpnSense knowledge.

Maybe it would help you to ask a friend with knowledge in the field to configure OpnSense for you.

And all I wanted to point you to is that the default of having OpnSense's WAN IPv6 assigned from a different range of IPv6 (namely a single IA_NA address) than the LAN(s) (namely IPv6 /64 subnets that are extracted out of a /56 IA_PD prefix) makes it harder to see what is going on, because the IPv6 that you use from OpnSense's WAN will be much different from the LAN subnet IPv6s.

Plus, you try to use DHCPv6 on the LAN side, which is suboptimal in most consumer-type internet access scenarios.

Also, IDK how you have set up your firewall rules for IPv6.

All of the why and how is explained in the HOWTO - that is why I wrote it, but, alas, I cannot explain it any better than that.