DHCPv6 Prefix Delegation not working on IPoE (non-PPPoE) connection

[shiphrah]

DHCPv6 Prefix Delegation not working on IPoE (non-PPPoE) connection

Environment

• OPNsense version: 25.10.2 Business Edition
• WAN connection type: IPoE (Deutsche Glasfaser FTTH)
• IPv4: DHCP, CGN address (100.x.x.x), no PPPoE
• IPv6: DHCPv6, "Request only an IPv6 prefix" enabled, Prefix delegation size /56

Description

On an IPoE connection where the ISP delegates only an IPv6 prefix via DHCPv6-PD
(no global WAN IPv6 address), the delegated prefix does not appear on the WAN
interface and IPv6 routing does not work, despite the DHCPv6 exchange completing
successfully.

Steps to reproduce

1. Configure WAN interface: IPv4 DHCP, IPv6 DHCPv6, "Request only an IPv6 prefix"
   enabled, Prefix delegation size 56
2. Configure a LAN/VLAN interface: IPv6 "Track Interface" pointing to WAN, Prefix ID 0
3. Apply configuration

Observed behavior

1. DHCPv6 exchange succeeds (confirmed by tcpdump):

IP6 fe80::f690:eaff:fe01:f02.546 > ff02::1:2.547: dhcp6 solicit
  (IA_PD IAID:3 T1:0 T2:0 (IA_PD-prefix ::/56 pltime:4294967295 vltime:4294967295))

IP6 fe80::22.547 > fe80::f690:eaff:fe01:f02.546: dhcp6 advertise
  (IA_PD IAID:3 T1:1800 T2:2880 (IA_PD-prefix 2a00:6020:9842:2f00::/56
  pltime:3600 vltime:3600))
  (DNS-server 2a00:6020:100::1 2a00:6020:200::1)

IP6 fe80::f690:eaff:fe01:f02.546 > ff02::1:2.547: dhcp6 request
  (IA_PD IAID:3 T1:0 T2:0 (IA_PD-prefix 2a00:6020:9842:2f00::/56 ...))

IP6 fe80::22.547 > fe80::f690:eaff:fe01:f02.546: dhcp6 reply
  (IA_PD IAID:3 T1:1800 T2:2880 (IA_PD-prefix 2a00:6020:9842:2f00::/56
  pltime:3600 vltime:3600))

2. Prefix is not retained on WAN interface:

# /usr/local/sbin/ifctl -i igc0 -6pd
delete net 2a00:6020:9842:2f00::/56

# ifconfig igc0 | grep inet6
inet6 fe80::f690:eaff:fe01:f02%igc0 prefixlen 64 scopeid 0x1

No global IPv6 address on WAN, no "Prefix Delegated" shown under
Interfaces → Overview.

3. No IPv6 routing possible:

# ping6 -c 3 2a00:6020:100::1
3 packets transmitted, 0 packets received, 100.0% packet loss

ISP gateway (link-local) is reachable, confirming physical connectivity:

# ping6 -c 3 -S fe80::f690:eaff:fe01:f02%igc0 fe80::22%igc0
3 packets transmitted, 3 packets received, 0.0% packet loss

4. Release loop observed during initial configuration:

When the LAN/VLAN interface was set to "Track Interface", a release loop was
observed in tcpdump — dhcp6c repeatedly received the prefix and immediately
sent a Release. The loop stopped after several Apply Changes and dhcp6c restarts,
but the root cause could not be conclusively determined. The dhcp6c debug output
showed:

Sending Solicit
Sending Request
Received REPLY for REQUEST
add net 2a00:6020:9842:2400::/56: gateway ::1
restarting
Start address release
Sending Release
duplicated interface: igc0

The "duplicated interface" message suggests a second dhcp6c instance was started
while the first was still running.

Generated dhcp6c configuration

interface igc0 {
  send ia-pd 3;
  request domain-name-servers;
  request domain-name;
  script "/var/etc/dhcp6c_opt2_script.sh";
};
id-assoc pd 3 {
  prefix ::/56 infinity;
};

Expected behavior

The delegated prefix should be retained on the WAN interface, appear as
"Prefix Delegated" under Interfaces → Overview, and IPv6 routing should work.
LAN/VLAN interfaces with Track Interface should receive their /64 subnets
and clients should have working IPv6 connectivity.

Workaround

None found.

[fichtner]

Hi,

According to the dhcp6c configuration you're requesting a PD but not assigning it anywhere (certainly not on WAN which is also not the default and optional for at least two separate reasons).

Cheers,
Franco

[shiphrah]

Hi Franco,

thanks for the hint. I'm a bit lost. The dhcp6c.conf is auto-generated by OPNsense — I didn't write it manually, so I can't explain why there is no prefix-interface directive in it. My VLANs are configured with "Track Interface" pointing to WAN — is that not sufficient to make OPNsense generate the correct dhcp6c.conf?

Looking further, I also noticed that the delegated prefix ends up routed to loopback:
2a00:6020:9842:2f00::/56 link#10 USB lo0
The default route via the ISP gateway looks correct (fe80::22%igc0), but outbound ping6 from OPNsense to the ISP fails.

Could these two things be related?

Thanks,
Jürgen

[fichtner]

Hi Jürgen,

Everything is normal here. You don't seem to be using a LAN which is the only interface that receives a prefix in a default install. The full prefix route is the blackhole route.

If you want a prefix on WAN you need to set "Optional prefix ID" to an available prefix ID 0, 1, 2, etc.

Cheers,
Franco

[shiphrah]

Hi Franco,

thanks again for your help. After setting the Optional prefix ID on WAN, the interface
now has a global IPv6 address and the routing table looks like this:

default                        fe80::22%igc0    UG     igc0
2a00:6020:9842:2f00::/64       link#1           U      igc0
2a00:6020:9842:2f00::/56       link#10          USB    lo0

tcpdump on igc0 shows that echo requests leave OPNsense correctly, but no reply
ever arrives:

2a00:6020:9842:2f00:f690:eaff:fe01:f02 > dnscache001.dg-w.de: ICMP6, echo request
2a00:6020:9842:2f00:f690:eaff:fe01:f02 > dnscache001.dg-w.de: ICMP6, echo request
(no replies)

Can we safely conclude that the problem is with the ISP and not with OPNsense?

Thanks

Jürgen

[fichtner]

Hi Jürgen,

At first glance I’d say so. Though there’s little chance to diagnose this further in community source scope if that’s not the case.

Cheers,
Franco