Prefix Delegation - need to change the firewall settings

[fengchen_opn]

Versions
OPNsense 26.1.11_6-amd64


According to the documentation at https://docs.opnsense.org/manual/kea.html#prefix-delegation-ia-pd, the PC can't access the internet.
I checked and found that I need to change the firewall rule 'Default allow LAN IPv6 to any'. Change the 'Source' from 'lan network' to 'any'

[meyergru]

Yes, of course. That is because the delegated prefix (IA_PD) is not within the 'lan network'.

Delegating IPv6 prefixes is an "advanced" topic. The "default allow" rules for the first LAN are legacy convenience rules designed for the standard case only. Also, these rules exist ONLY for the first (V)LAN. You have to create suited rules for any additional (V)LAN by yourself - likewise when you create networks behind your LAN.