IPv6 configuration on OpenWrt: WAN, prefix delegation, RA, and relay

IPv6 on OpenWrt has two halves: receiving an address/prefix upstream and distributing a prefix downstream to LAN. I do not treat a single checkbox as a finished configuration; I identify whether the ISP uses native DHCPv6, PPPoE, static addressing, relay, or a tunnel, then test RA, DHCPv6, routes, and source policy.¹

Compliance and general features

The default firmware commonly includes odhcp6c as the DHCPv6 client, odhcpd as the RA/DHCPv6 server, and IPv6 firewall support; LuCI needs luci-proto-ipv6. A custom image must include the corresponding packages. The source aims at RFC 7084 but lists known gaps, so I test the actual behavior instead of treating the RFC target as an absolute guarantee.¹

The important capabilities are address/prefix/route management, prefix unreachable routes, prefix classes, source-based policy routing, SLAAC, stateless/stateful DHCPv6, DHCPv6-PD, lifetime handling, DAD, MTU detection, and relay/NDP proxying.

Upstream WAN configuration

Native IPv6 connection

For a native upstream, this example uses a dhcpv6 wan6 interface and delegates a /60 to LAN. eth1 is only an example; the real topology may use a VLAN, @wan, or another device.¹

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# cat /etc/config/network
config interface wan
        option ipv6 1 # only required for PPP-based protocols
        ...

config interface wan6
        option device   eth1 # use same device as in wan-section or "@wan"
        option proto    dhcpv6

config interface lan
        option proto    static
        option ip6assign 60
        ...

For DHCPv6 on WAN, the firewall must allow DHCPv6 replies from UDP port 547 to port 546 as shown by the source:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# cat /etc/config/firewall
....
config rule
        option target 'ACCEPT'
        option src 'wan'
        option proto 'udp'
        option dest_port '546'
        option name 'Allow DHCPv6 replies'
        option family 'ipv6'
        option src_port '547'

PPP-based protocols and option ipv6

PPPoE/PPPoA require option ipv6 in the parent wan interface. 0 disables IPv6; 1 enables IPCP6 negotiation but leaves the remaining configuration to a manually configured wan6; auto is the default, creates wan_6, and starts odhcp6c. With auto, LAN needs ip6assign 64 or a larger prefix length to distribute the delegated prefix. I do not add a manual wan6 when the automatically spawned wan_6 already matches the ISP.¹

Options for the dhcpv6 protocol

The table keeps the option names and practical meanings from the source because omitting one of these is a common cause of incomplete IPv6 setups:

For automatic DS-Lite from DHCPv6, the source requires an interface with option auto 0, its name in iface_dslite, and that interface added to a suitable firewall zone.¹

Static IPv6 connection

When the ISP assigns static values, retain ip6addr, ip6gw, ip6prefix, and DNS as in the following example. The 2001:db80:: addresses are documentation values, not values to copy into a real network.¹

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# cat /etc/config/network
config interface wan
        option device   eth1
        option proto    static
        option ip6addr  2001:db80::2/64   # Own address
        option ip6gw    2001:db80::1      # Gateway address
        option ip6prefix 2001:db80:1::/48 # Prefix addresses for distribution to downstream interfaces
        option dns      2001:db80::1      # DNS server

config interface lan
        option proto    static
        option ip6assign 60
        ...

Downstream LAN configuration

Static IPv6 options

ip6addr assigns an address; ip6ifaceid can be eui64, random, or a fixed suffix; ip6gw is the gateway; ip6assign controls the delegated prefix length; ip6hint is a hexadecimal subprefix ID; ip6prefix routes a prefix to other interfaces; ip6class filters prefix classes; and dns, dns_search, dns_metric, and metric control DNS and route selection. These options belong to the static protocol and should not be mixed blindly with DHCPv6 assumptions.

Prefix delegation with ip6assign, ip6hint, and ip6class

• ip6assign 64 delegates /64 prefixes to an interface.
• ip6hint suggests an ID, for example 1234 can produce ...:1234::/64.
• ip6class wan6 accepts only the wan6 prefix class; local accepts only ULA.
• If the prefix is insufficient, OpenWrt can change the ID or reduce the length; an unsuitable ip6hint is rounded down.
• An ip6assign value below 64 lets DHCPv6-PD hand remaining /64s to downstream routers.

The source's LAN/guest example retains ULA, selects prefixes with ip6hint, and restricts guest to class wan6:¹

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

# cat /etc/config/network
config globals globals
        option ula_prefix fd00:db80::/48

config interface wan6
        option proto static
        option ip6prefix 2001:db80::/56
        ...

config interface lan
        option proto static
        option ip6assign 60
        option ip6hint 10
        ...

config interface guest
        option proto static
        option ip6assign 64
        option ip6hint abcd
        list ip6class wan6
        ...

In that example, lan receives 2001:db80:0:10::/60 and fd00:db80:0:10::/60, while guest receives only 2001:db80:0:abcd::/64. If the router can ping6 but LAN clients report Destination unreachable: Unknown code 5 or Source address failed ingress/egress policy, I check ip6assign on LAN first.

Router Advertisement and DHCPv6

SLAAC and DHCPv6

OpenWrt can advertise RA, provide stateless/stateful DHCPv6, and offer DHCPv6-PD. The combined SLAAC and DHCPv6 server example is:

1
2
3
4
5
6

# cat /etc/config/dhcp
config dhcp lan
    option dhcpv6 server
    option ra server
    option ra_flags 'managed-config other-config'
    ...

The source notes that a tunnel with a fixed LAN prefix should remove ndp when NDP proxying is not wanted.

SLAAC only

For SLAAC-only clients, disable DHCPv6 and clear the RA flags as follows. The source notes that some clients, including Android, may prefer IPv4 when DHCPv6 is disabled:¹

1
2
3
4
5
6

# cat /etc/config/dhcp
config dhcp lan
    option dhcpv6 disabled
    option ra server
    list ra_flags 'none'
    ...

IPv6 relay

Relay helps when an upstream router provides IPv6 but no DHCPv6-PD. This is the source's two-sided relay configuration:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# cat /etc/config/dhcp
config dhcp lan
    option dhcpv6 relay
    option ra relay
    option ndp relay
    ...

config dhcp wan6
    option dhcpv6 relay
    option ra relay
    option ndp relay
    option master 1
    option interface wan6

Routing management

OpenWrt uses source-address/source-interface policy routing for multiple uplinks. Delegated prefixes can receive unreachable routes to prevent loops. I inspect ifstatus wan6; the following shortened sample shows a /64 address, a /56 delegated prefix assigned as /60 to LAN, and a default route through a link-local gateway:¹

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

...
        "ipv6-address": [
                {
                        "address": "2001:db80::a00:27ff:fe67:cd9c",
                        "mask": 64,
                        "preferred": 1681,
                        "valid": 7081
                }
        ],
        "ipv6-prefix": [
                {
                        "address": "2001:db80:0:100::",
                        "mask": 56,
                        "preferred": 86282,
                        "valid": 86282,
                        "class": "wan6",
                        "assigned": {
                                "lan": {
                                        "address": "2001:db80:0:110::",
                                        "mask": 60
                                }
                        }
                }
        ],
        "route": [
                {
                        "target": "2001:db80::",
                        "mask": 48,
                        "nexthop": "fe80::800:27ff:fe00:0",
                        "metric": 1024,
                        "valid": 7081
                },
                {
                        "target": "::",
                        "mask": 0,
                        "nexthop": "fe80::800:27ff:fe00:0",
                        "metric": 1024,
                        "valid": 7081
                }
        ],
...

Read two details from the output: 2001:db80::/48 and ::/0 use fe80::800:27ff:fe00:0, but only traffic with a suitable source address can use them. A route table alone is not enough; test from a LAN client.

ULA prefix

ULA can provide stable IPv6 suffixes with DHCPv6, site-to-site connectivity when the GUA changes or disappears, or NAT66 when the ISP supplies no GUA. Without a GUA, I treat this as a limited workaround rather than claiming ULA is Internet-routable.

Testing and recovery

After reloading the network, check ifstatus wan6, ip -6 addr, ip -6 route, RA on a client, and firewall logs. If the new configuration breaks access, restore the prepared /etc/config/network and /etc/config/dhcp copies through console; never paste the source's example prefix into a production network unchanged.

Sources