Home › Docs › pfSense IPv6 Setup Guide: Complete Configuration Walkthrough

pfSense IPv6 Setup Guide: Complete Configuration Walkthrough

pfSense is a powerful open-source firewall and router platform based on FreeBSD. Properly configuring IPv6 on pfSense enables your network to take full advantage of the modern internet while maintaining robust security. This comprehensive guide covers WAN configuration, LAN setup, DHCPv6, Router Advertisements, firewall rules, and troubleshooting for both simple and complex network scenarios.

Table of Contents

Understanding pfSense IPv6 Architecture

pfSense handles IPv6 using a dual-stack approach, running IPv4 and IPv6 simultaneously without interference. The key architectural concepts include:

Prefix Delegation

Most residential and business ISPs provide IPv6 connectivity through DHCPv6 Prefix Delegation (DHCPv6-PD). Your ISP delegates an IPv6 prefix to your pfSense WAN interface, typically:

pfSense then subdivides this delegated prefix to assign /64 subnets to your internal networks (LAN, DMZ, VLANs, etc.).

Track Interface

The "Track Interface" feature is pfSense's mechanism for automatically configuring internal interfaces with subnets from the delegated prefix. When you set a LAN interface to "Track Interface" pointing to WAN, pfSense automatically:

  1. Receives a prefix delegation from the ISP
  2. Assigns a /64 subnet from that delegation to the LAN
  3. Updates the subnet when the delegation changes
  4. Handles Router Advertisements for that subnet

This eliminates manual IPv6 address management and ensures your internal networks remain functional even if your ISP changes your delegated prefix.

Router Advertisements vs DHCPv6

Unlike IPv4, where DHCP handles all client configuration, IPv6 uses two complementary mechanisms:

Router Advertisements (RA): ICMPv6 messages that provide:

DHCPv6: Optional protocol that provides:

For most pfSense deployments, you'll use Router Advertisements for gateway discovery and either SLAAC or DHCPv6 for address assignment.

Prerequisites and Planning

Before configuring IPv6 on pfSense, verify the following:

1. ISP IPv6 Support

Confirm your ISP provides native IPv6 connectivity. Contact their support or check your modem's status page for:

Without ISP support, you'll need to use a tunnel broker (Hurricane Electric, etc.), which is beyond the scope of this guide.

2. pfSense Version

This guide applies to pfSense 2.6 and later (including pfSense Plus). Earlier versions may have different menu structures. Check your version under System > Update.

3. Network Planning

Determine your internal network structure:

For a /56 delegation, you have prefix IDs 0 through ff (256 subnets). For a /60 delegation, you have prefix IDs 0 through f (16 subnets).

4. Gather Information

You'll need:

WAN Interface Configuration

The WAN interface connects pfSense to your ISP and receives the IPv6 prefix delegation. Most residential and business connections use DHCPv6 with prefix delegation.

Accessing WAN Configuration

  1. Log into pfSense web interface (typically https://192.168.1.1)
  2. Navigate to Interfaces > WAN
  3. Scroll to the IPv6 Configuration section

DHCPv6 Configuration (Most Common)

For ISPs that provide IPv6 via DHCPv6 Prefix Delegation:

IPv6 Configuration Type:

DHCPv6 Prefix Delegation Size:

Send IPv6 prefix hint:

Request only an IPv6 prefix:

Configuration Example:

IPv6 Configuration Type: DHCP6
DHCPv6 Prefix Delegation size: 60
Send IPv6 prefix hint: [checked] (for most ISPs)
Request only an IPv6 prefix: [unchecked]

Click Save and Apply Changes at the bottom of the page.

SLAAC Configuration

Some ISPs provide IPv6 through SLAAC (Stateless Address Autoconfiguration) with prefix delegation:

IPv6 Configuration Type:

Configuration ID:

DHCPv6 Prefix Delegation Size:

Static IPv6 Configuration

For business connections with static IPv6 assignments:

IPv6 Configuration Type:

IPv6 Address:

IPv6 Upstream Gateway:

Delegated Prefix:

PPPoEv6 Configuration

For DSL connections using PPPoE with IPv6:

  1. Configure PPPoE under Interfaces > WAN
  2. Set IPv6 Configuration Type to DHCP6
  3. Configure prefix delegation as described above
  4. PPPoE credentials go in the IPv4 configuration section

Verification

After configuring the WAN interface, verify IPv6 connectivity:

  1. Navigate to Status > Interfaces
  2. Check the WAN interface section
  3. Verify you see:
    • An IPv6 Address (starting with 2xxx: or 3xxx:, not fe80:)
    • Track6 Prefix Delegation showing your delegated prefix

If you see no IPv6 address after 30 seconds, check your ISP connection or configuration settings.

LAN Interface Configuration

Once your WAN interface receives an IPv6 prefix delegation, configure your LAN interface to use a subnet from that delegation using the Track Interface feature.

Basic LAN Configuration

  1. Navigate to Interfaces > LAN
  2. Scroll to the IPv6 Configuration section

IPv6 Configuration Type:

This selection reveals additional Track IPv6 Interface settings.

Track IPv6 Interface Configuration

IPv6 Interface:

IPv6 Prefix ID:

Manual Configuration (Optional):

Configuration Example:

IPv6 Configuration Type: Track Interface
IPv6 Interface: WAN
IPv6 Prefix ID: 0

Click Save and Apply Changes.

Static LAN IPv6 Configuration (Alternative)

If you have a static IPv6 prefix and prefer manual configuration:

IPv6 Configuration Type:

IPv6 Address:

This approach requires manual updates if your ISP changes your prefix, so Track Interface is strongly preferred for dynamic scenarios.

Verification

  1. Navigate to Status > Interfaces
  2. Check the LAN interface section
  3. Verify you see:
    • IPv6 Address (should be from the delegated prefix)
    • The address should end with ::1 (pfSense's gateway address)
    • Example: 2001:db8:1234:5600::1/64

DHCPv6 Server Setup

DHCPv6 can provide IPv6 addresses and configuration to your clients. However, unlike DHCPv4, DHCPv6 cannot provide default gateway information - that comes from Router Advertisements. You can use DHCPv6 in two modes:

Accessing DHCPv6 Server Configuration

  1. Navigate to Services > DHCPv6 Server
  2. Click the LAN tab (or whichever interface you're configuring)

Stateful DHCPv6 Configuration

For centralized address management with DHCPv6-assigned addresses:

Enable DHCPv6 server on LAN interface:

Range:

Prefix Delegation Range:

DNS Servers:

Domain Name:

Domain Search List:

Default lease time:

Maximum lease time:

Configuration Example:

Enable DHCPv6 server: [checked]
Range: 2001:db8:1234:5600::1000 to 2001:db8:1234:5600::1fff
DNS Servers: 2001:4860:4860::8888, 2001:4860:4860::8844
Domain name: home.local
Default lease time: 86400
Maximum lease time: 604800

Stateless DHCPv6 Configuration (With SLAAC)

For networks where clients should use SLAAC for addresses but receive DNS via DHCPv6:

  1. Enable DHCPv6 server as above
  2. Set Range fields to empty or a very small range
  3. Configure DNS servers as desired
  4. Set Router Advertisement mode to Assisted (configured in next section)

This configuration allows maximum client compatibility while providing centralized DNS configuration.

DHCPv6 Static Mappings

To assign specific IPv6 addresses to particular devices:

  1. Scroll to DHCPv6 Static Mappings section
  2. Click Add

DUID:

IPv6 Address:

Hostname:

Description:

Click Save and Apply Changes.

Important DHCPv6 Notes

  1. Android Incompatibility: Android devices do not support DHCPv6. They require SLAAC with RDNSS (Router Advertisements with DNS). If you need to support Android, enable SLAAC.

  2. Gateway Information: DHCPv6 cannot provide default gateway information. Clients learn their gateway from Router Advertisement messages, configured in the next section.

  3. Firewall Rules: DHCPv6 uses UDP ports 546 (client) and 547 (server). pfSense's default LAN rules allow this traffic.

Router Advertisements Configuration

Router Advertisements are critical for IPv6 operation. They provide default gateway information, prefix announcements, and control whether clients use SLAAC, DHCPv6, or both.

Accessing Router Advertisement Configuration

  1. Navigate to Services > Router Advertisement
  2. Click the LAN tab (or whichever interface you're configuring)

Router Advertisement Modes

Router mode:

Select the appropriate mode based on your desired client behavior:

Unmanaged:

Managed:

Assisted:

Stateless DHCP:

Router Priority:

For most home and small business networks:

Router mode: Assisted
Router Priority: Normal

This configuration:

Advanced Router Advertisement Options

RA Interface:

RA Subnet(s):

Default Valid Lifetime:

Default Preferred Lifetime:

RA Flags:

Configuration for Different Scenarios

Maximum Compatibility (Home Network):

Router mode: Assisted

Clients use SLAAC; DHCPv6 provides DNS.

Enterprise with Address Tracking:

Router mode: Managed
DHCPv6 Server: Enabled with address range

Note: Breaks Android device connectivity.

SLAAC Only (No DHCPv6):

Router mode: Unmanaged
DHCPv6 Server: Disabled

Clients auto-configure; no centralized DNS control.

Click Save after configuring Router Advertisements.

IPv6 Firewall Rules

Proper IPv6 firewall configuration is essential for security. Unlike IPv4, where NAT provided incidental security through address translation, IPv6 devices are globally addressable. Your firewall rules are your primary defense.

Default pfSense IPv6 LAN Rules

By default, pfSense includes a rule on the LAN interface that allows all IPv4 and IPv6 traffic outbound. Verify this exists:

  1. Navigate to Firewall > Rules
  2. Click the LAN tab
  3. Look for a rule with:
    • Action: Pass
    • Interface: LAN
    • Address Family: IPv6 or IPv6+IPv4
    • Source: LAN net
    • Destination: Any

If this rule exists, your LAN clients can access the internet over IPv6. If it's missing, you'll need to create it.

Essential ICMPv6 Rules

Unlike ICMPv4, which could be largely blocked, ICMPv6 is essential for IPv6 operation. Critical ICMPv6 types include:

Good news: pfSense's default rules handle this correctly. The "Default allow LAN to any" rule permits ICMPv6 traffic.

Important: Never completely block ICMPv6. Your IPv6 network will break without it.

WAN IPv6 Firewall Rules

By default, pfSense blocks all unsolicited inbound traffic on the WAN interface (both IPv4 and IPv6). This default-deny approach is secure and recommended.

To verify default WAN rules:

  1. Navigate to Firewall > Rules
  2. Click the WAN tab
  3. You should see minimal rules, typically only for specific services you're hosting

The implicit deny rule blocks everything not explicitly allowed.

Creating Custom IPv6 Rules

To host services accessible over IPv6, create explicit allow rules.

Example: Allow IPv6 HTTP/HTTPS to Web Server

  1. Navigate to Firewall > Rules
  2. Click the WAN tab
  3. Click Add (bottom of list)

Configure:

Click Save and create a second rule for HTTPS (port 443).

Example: Allow IPv6 SSH to pfSense

To access pfSense's SSH over IPv6:

  1. Enable SSH under System > Advanced > Admin Access
  2. Navigate to Firewall > Rules > WAN
  3. Click Add

Configure:

Best Practices for IPv6 Firewall Rules

  1. Default Deny: Never create an "allow all" rule on WAN
  2. Least Privilege: Only allow specific ports to specific destinations
  3. Use Aliases: Create aliases for frequently used addresses or ports
  4. Mirror IPv4 Rules: Your IPv6 security policies should match IPv4
  5. Don't Block ICMPv6: Allow essential ICMPv6 types (especially Type 2)
  6. Log Suspicious Activity: Enable logging on deny rules during troubleshooting
  7. Use Description Fields: Document the purpose of each rule

Firewall Rule Order

pfSense processes rules top-to-bottom, first-match-wins. Order your rules:

  1. Block rules (if any specific blocks needed)
  2. Allow rules for specific services
  3. Default allow LAN to any (bottom of LAN rules)
  4. Implicit deny-all (automatic on WAN)

Common Firewall Rule Mistakes

Mistake 1: Blocking All ICMPv6 Never create a rule blocking protocol ICMPv6 entirely. This breaks Path MTU Discovery and Neighbor Discovery.

Mistake 2: Enabling Bogon Blocking on LAN Under Interfaces > LAN, don't check "Block bogon networks" for IPv6. This blocks link-local addresses (fe80::/10) which are essential for Router Advertisements and Neighbor Discovery.

Mistake 3: No Stateful Rules Always use stateful firewall rules (enabled by default in pfSense). The "keep state" option allows return traffic for established connections.

Multiple LAN and VLAN Scenarios

For networks with multiple internal segments (DMZ, guest WiFi, VLANs), each needs its own /64 subnet from your delegated prefix.

Planning Multiple Subnets

Given a /60 delegation (16 subnets available), you might allocate:

For a /56 delegation (256 subnets), you have much more flexibility.

Configuring Additional Interfaces

Example: Setting up DMZ (OPT1) with IPv6

  1. Navigate to Interfaces > OPT1 (or your DMZ interface)
  2. Enable the interface if not already enabled

IPv6 Configuration:

Click Save and Apply Changes.

DHCPv6 for Additional Interfaces

  1. Navigate to Services > DHCPv6 Server
  2. Click the OPT1 (or DMZ) tab
  3. Configure as you did for LAN:
    • Enable DHCPv6 server
    • Set address range (e.g., ::1000 to ::1fff)
    • Configure DNS servers

Router Advertisements for Additional Interfaces

  1. Navigate to Services > Router Advertisement
  2. Click the OPT1 (or DMZ) tab
  3. Set Router mode to your desired mode (typically Assisted or Unmanaged)
  4. Click Save

Firewall Rules for Additional Interfaces

For DMZ or guest networks, you typically want to:

Example: Guest WiFi Rules

Navigate to Firewall > Rules > OPT2 (Guest WiFi), then create:

Rule 1: Block access to LAN

Rule 2: Block access to DMZ

Rule 3: Allow internet access

Order matters - block rules must come before allow rules.

VLAN Configuration with IPv6

For networks using 802.1Q VLANs:

  1. Create VLANs under Interfaces > Assignments > VLANs
  2. Assign VLAN interfaces under Interfaces > Assignments
  3. Configure each VLAN interface with Track Interface and unique Prefix ID
  4. Configure DHCPv6 and Router Advertisements per VLAN
  5. Create firewall rules per VLAN

Each VLAN gets its own /64 subnet from your delegated prefix, identified by the Prefix ID.

Verification of Multiple Subnets

  1. Navigate to Status > Interfaces
  2. Verify each interface shows a unique IPv6 address from delegated prefix
  3. Example:
    • LAN: 2001:db8:1234:5600::1/64 (prefix ID 0)
    • DMZ: 2001:db8:1234:5601::1/64 (prefix ID 1)
    • Guest: 2001:db8:1234:5602::1/64 (prefix ID 2)

Troubleshooting Common Issues

Issue 1: No IPv6 Address on WAN

Symptoms:

Diagnosis:

  1. Navigate to Status > System Logs > System
  2. Search for "dhcp6c" messages
  3. Check for errors about prefix delegation

Solutions:

Advanced debugging:

# SSH to pfSense and run:
dhcp6c -d -D -c /var/etc/dhcp6c_wan.conf igb0  # Replace igb0 with WAN interface

Look for ISP responses or timeouts.

Issue 2: WAN Has IPv6 but No Delegated Prefix

Symptoms:

Diagnosis: Check if any LAN interfaces are configured with Track Interface. pfSense only requests prefix delegation if at least one interface is tracking the WAN.

Solutions:

  1. Configure at least one LAN interface with Track Interface
  2. Ensure "Request only an IPv6 prefix" is unchecked on WAN
  3. Try checking "Send IPv6 prefix hint" on WAN
  4. Verify DHCPv6 Prefix Delegation size matches ISP requirement
  5. Restart dhcp6c service: Status > Services, restart dhcp6c

Issue 3: LAN Has No IPv6 Addresses

Symptoms:

Diagnosis:

Solutions:

  1. Navigate to Interfaces > LAN
  2. Verify IPv6 Configuration Type is "Track Interface"
  3. Verify IPv6 Interface is "WAN"
  4. Try Prefix ID 0
  5. Click Save and Apply Changes
  6. Check Status > Interfaces for updated LAN IPv6 address

Issue 4: Clients Not Getting IPv6 Addresses

Symptoms:

Diagnosis: Check Router Advertisement and DHCPv6 configuration:

  1. Navigate to Services > Router Advertisement > LAN
  2. Verify Router mode is not "Disabled"
  3. Check Services > DHCPv6 Server > LAN
  4. Verify DHCPv6 server is enabled (if using stateful mode)

Solutions:

Client-side testing:

Windows:

ipconfig /release6
ipconfig /renew6
ipconfig /all

Linux:

sudo dhclient -6 -r eth0
sudo dhclient -6 -v eth0
ip -6 addr show

macOS:

sudo ipconfig set en0 AUTOMATIC-V6
ifconfig en0 inet6

Issue 5: Clients Have IPv6 but No Internet Access

Symptoms:

Diagnosis: Check firewall rules and routing:

  1. Navigate to Firewall > Rules > LAN
  2. Verify a rule allows LAN IPv6 to any destination
  3. Check Diagnostics > States for IPv6 connections

Solutions:

Issue 6: IPv6 Connectivity is Intermittent

Symptoms:

Diagnosis: Check for prefix delegation changes:

  1. Navigate to Status > System Logs > System
  2. Search for "prefix changed" or "dhcp6c"
  3. ISP may be changing your delegated prefix

Solutions:

Issue 7: DHCPv6 Server Not Handing Out Addresses

Symptoms:

Diagnosis: Check Router Advertisement mode and flags:

  1. Navigate to Services > Router Advertisement > LAN
  2. Check Router mode setting

Solutions:

Issue 8: "No IPv6 Connectivity" After pfSense Upgrade

Symptoms:

Solutions:

  1. Reboot pfSense: Diagnostics > Reboot
  2. Release and renew WAN DHCPv6: Status > Interfaces, click refresh icon
  3. Check interface configurations weren't reset
  4. Reconfigure Track Interface settings if needed
  5. Review release notes for IPv6-related changes

Issue 9: IPv6 DNS Not Working

Symptoms:

Diagnosis: Check DNS configuration:

  1. Navigate to System > General Setup
  2. Verify DNS servers are configured
  3. Check if DNS servers support IPv6

Solutions:

nslookup google.com 2001:4860:4860::8888

Issue 10: pfSense Reboots and IPv6 Breaks

Symptoms:

Solutions:

  1. Wait 2-3 minutes after reboot for DHCPv6 to complete
  2. Navigate to Status > Services
  3. Restart "dhcp6c" service if it's stopped
  4. Check Status > System Logs > System for errors during boot
  5. May indicate ISP connectivity issue or configuration problem

Advanced Debugging Commands

SSH into pfSense and use these commands:

# Check WAN DHCPv6 client status
/usr/local/sbin/dhcp6c -d -D -c /var/etc/dhcp6c_wan.conf igb0  # Replace igb0

# Show IPv6 addresses on all interfaces
ifconfig | grep inet6

# Show IPv6 routing table
netstat -rn -f inet6

# Check Router Advertisement daemon
radvdump  # Shows received RAs

# Capture DHCPv6 traffic
tcpdump -ni igb0 -vvv port 546 or port 547  # Replace igb0

# Test IPv6 connectivity from pfSense
ping6 2001:4860:4860::8888

# Show active IPv6 connections
sockstat -6

# Check DHCPv6 server leases
cat /var/dhcpd/var/db/dhcpd6.leases

Testing Your Configuration

After configuring IPv6 on pfSense, thorough testing ensures everything works correctly.

Test 1: Verify pfSense Interfaces

  1. Navigate to Status > Interfaces
  2. Check WAN interface:
    • IPv6 Address: Should be a global address (2xxx: or 3xxx:)
    • Track6 Prefix Delegation: Should show your delegated prefix
  3. Check LAN interface:
    • IPv6 Address: Should be from delegated prefix with ::1
  4. Check additional interfaces if configured

Test 2: Verify DHCPv6 Leases

  1. Navigate to Status > DHCPv6 Leases
  2. Check for client devices receiving addresses
  3. Verify addresses are from expected range

Test 3: Check Client IPv6 Addresses

On a client device:

Windows:

ipconfig /all

Look for "IPv6 Address" (not Teredo or 6to4).

Linux:

ip -6 addr show

Look for "scope global" addresses.

macOS:

ifconfig en0 | grep inet6

Verify the address is from your delegated prefix.

Test 4: Connectivity Testing from Client

Ping IPv6 Addresses:

# Windows
ping -6 2001:4860:4860::8888

# Linux/macOS
ping6 2001:4860:4860::8888

Test DNS Resolution:

# Windows
nslookup google.com

# Linux/macOS
dig AAAA google.com

Verify you receive IPv6 (AAAA) records.

Test 5: Comprehensive Online Testing

Use https://test-ipv6.run from a client device on your network. This comprehensive testing tool checks:

What to expect:

If test-ipv6.run shows failures, it will indicate which specific test failed:

Test 6: Firewall Rule Verification

  1. Navigate to Diagnostics > States
  2. Filter by IPv6
  3. Verify you see active IPv6 connections
  4. This confirms firewall rules are allowing traffic

Test 7: Test from External Network

From a device outside your network with IPv6:

# Test ping (if allowed by firewall)
ping6 your-wan-ipv6-address

# Test hosted services
curl -6 http://[your-wan-ipv6-address]/

# Test SSH (if allowed)
ssh -6 user@your-wan-ipv6-address

Test 8: Check Logs for Errors

  1. Navigate to Status > System Logs > System
  2. Search for "dhcp6c" or "radvd"
  3. Look for errors or warnings
  4. Healthy logs show successful prefix delegation and renewals

Best Practices and Recommendations

Security Best Practices

  1. Firewall Rules: Maintain strict inbound rules on WAN, allowing only necessary services
  2. Don't Block ICMPv6: Allow essential ICMPv6 types (especially Type 2: Packet Too Big)
  3. Keep Firmware Updated: Regularly update pfSense for security patches
  4. Disable Unused Services: Turn off services you don't need
  5. Monitor Logs: Regularly review firewall logs for suspicious activity

Configuration Best Practices

  1. Use Track Interface: Prefer Track Interface over static IPv6 for internal networks
  2. Assisted Router Mode: Use "Assisted" for maximum client compatibility
  3. Longer DHCP Leases: IPv6 allows longer lease times (days or weeks)
  4. Document Prefix IDs: Keep a record of which Prefix ID is assigned to which network
  5. Test After Changes: Always verify connectivity after configuration changes

Network Design Best Practices

  1. One /64 Per Segment: Each LAN/VLAN gets its own /64 subnet
  2. Reserve Prefix IDs: Leave room for future network expansion
  3. Plan VLANs First: Design VLAN structure before assigning Prefix IDs
  4. Static Mappings: Use DHCPv6 static mappings for servers and network devices
  5. Separate Guest Networks: Use different Prefix IDs and firewall rules for guest access

Conclusion

Configuring IPv6 on pfSense provides your network with modern internet connectivity, improved security features, and readiness for the future of networking. By following this guide, you've set up:

Remember to test your configuration thoroughly using test-ipv6.run and monitor your firewall logs for any issues. IPv6 is essential for the modern internet, and with pfSense properly configured, you're prepared for the growing IPv6-enabled web.

If you encounter issues not covered in this guide, consult the official pfSense documentation at docs.netgate.com or the pfSense community forums at forum.netgate.com.

Additional Resources