Setting up IPv6 - Firewall can ping out to internet, but clients can't

[bawjaws]

Hi! I'm trying to get IPv6 working on my local network. I've configured it as follows:

WAN: DHCPv6 (requested a /56 but been assigned a /64. I'll take that up with my ISP later, as I'm just looking to get one LAN working for now, which I think a /64 will let me do?)
LAN: SLAAC (using Identity Association)
Router Advertisements: Enabled for LAN i/f, Unmanaged mode, 30 and 60 interval timers

I've confirmed that all IPv6 capable devices are configuring themselves with an IPv6 address using the first 64 bits of the ISP-assigned address. They also have a bunch of other link-local and "temp" addresses.

I've updated the exsiting IPv4 firewall rules to now also include IPv6 traffic, and I've also allowed all IPv6 ICMP traffic.

The OPNSense box can ping on IPv6 out to the internet without a problem. However, clients on the LAN are unable to ping out to the internet. They can ping the link-local address of the default gateway (which is the OPNsense LAN interface), but they cannot ping the global IPv6 address of this interface.

I'm sort of at a loss now as to what the problem could be. I done a packet capture for the pings from clients, and it showed the ping going out to the internet, then the response coming back into the OPNsense box, but the next packet was then an ICMP unreachable back out to the internet - like the OPNSense box can't reach the IPv6 address configured on the LAN. One thing I noticed is that in the Neighbour Discovery table on OPNsense, it doesn't have an entry for the global IPv6 address for the client. I'd have expected this to have been populated.

Does anyone have any advice or suggestions?

Kevin

[bawjaws]

As always seems to be the case - typing out this message was all that was needed for the fix to be found! In my WAN config I had prefix ID 0 selected. Changing it to 1 seems to have fixed things!