OPNsense in an open source router/firewall software. It is similar to pfSense since they forked that project over 5 years ago. You can install this software on any PC that has multiple Ethernet ports (you can use a single port but that is not recommended) and use it in place of your home router or it can be used only for firewall purposes for your network.

That is one thing which gave me trouble. I noticed that not all of the devices would show up in the DHCPv6 leases like they would in IPv4 and it seems like only some would show their hostnames. My feeling from looking online is that IPv6 features are not as polished as IPv4 and that is not an issue with just OPNsense as it seems like IPv6 is not as well supported with other applications/devices. I hope this changes over time. Perhaps there are some tricks that can be done to have IPv6 functioning as well as IPv4, but I am thinking the IPv6 features need more work to perfect (across the industry as a whole too).

To work around the issue, there may be no other option but to statically map some of the devices that do not register their names in DNS. The funny thing in my personal network is that I have ended up statically mapping (via DHCP) a majority of the devices on my network so that I can have better hostnames or apply firewall rules to specific devices (in addition to firewall rules for each network/VLAN). Since statically mapping devices via DHCP is all done in OPNsense with the web GUI, it is way more convenient than configuring each device individually so it not a lot of work to setup and maintain. Of course for those with tons of devices, it would be more unwieldy but it is doable. Just be sure to backup your router configuration because it would be a lot of work to start over from scratch if your router crashes (it's also useful in case you hose your configuration and/or you want to experiment).

After experimenting with IPv6 to write this how-to, I turned it off on my network for the time being because it was causing issues that I did not have time to resolve. Some devices would default to IPv6 while others were happy to continue using IPv4 (or maybe the software does not support IPv6 addressing). I also wondered at how useful would it be to have everything on my internal network using IPv6 other than gaining experience in using IPv6. I know it is will be useful at some point to use it to access remote websites/services since the world is out of IPv4 addresses, but in my local network I am not so sure of the utility other than being able to have more than one public facing IP address, which would be nice when hosting various services on your network. The IPv6 address space is so huge and more awkward to use on a small network because of how long the address is and since hexadecimal is used. It's way easier to type and remember 192.168.1.1 than an IPv6 address. hehe.

I set the WAN to DHCPv6 to get an IPv6 address range from my ISP, which is similar to IPv4 except with IPv6 the ISPs will often allow you to request a larger address space so that you can have separate publicly addressable networks (but protected by the firewall) within your home network. On the LAN interface (and other interfaces if you have multiple networks), I am using "Track Interface" along with a prefix ID, which uses the DHCPv6 provided address on the WAN for the first half of the IPv6 address. The remaining portion of the address is dynamically assigned via Router Advertisements. I have configured my RA to be "Managed" which doesn't use SLAAC. The help comment in OPNsense says that "Managed" uses stateful DHCPv6. That may not necessarily work for all devices according to some research I did a while ago, which is why I made the comment that you may need to set it to "Assisted" to allow both stateful DHCPv6 and SLAAC.

I just tried to avoid using SLAAC in case it uses the MAC address for the second portion of the address which can reduce some privacy since your MAC address is now exposed as a publicly addressable IP (I think I've seen where the MAC address is no longer recommended for implementations of SLAAC so I'm not sure if OPNsense generates a unique identifier or not).

To be honest, I don't perfectly have everything set up in my network for IPv6. It was something I was experimenting with. I thought it would be nice to be able to implement IPv6 only at some point since that is supposed to be the future, but it certainly complicates small networks especially if your IPv6 address from the ISP can change and you wish to have a more complex network (with running various services and using firewall rules to restrict specific devices). I wish they assigned static IPv6 address ranges because the address space is so large that it should be possible to do. Having a dynamic address is a pain when you want to run servers that are exposed to the Internet and there's the issue of internal servers if your IPv6 is being assigned from your ISP and it changes. (There are ways to create static IPv6 addresses.. whether is is only the 2nd half of the IPv6 address or by using local IPv6 address ranges but that adds more configuration)

Thanks for the feedback! I'm glad it still works to this day, but you are correct in that I need to update this guide. I feel like I have a little better understanding of IPv6 than when I first wrote the guide.

1. I am pretty certain that the DHCPv6 rule was not an autogenerated rule on the WAN interface several years ago because I could not obtain an IPv6 address without adding the rule and I found another post which helped me overcome that hurdle. I'm am glad it is autogenerated now because that is an essential rule for basic functionality for IPv6 when using DHCPv6. It's one less thing to worry about. As for the LAN rules, I'm assuming you are referring to the default "allow all" rule? I would have to check the guide, but I may (or may not) have mentioned removing or changing the default rule to do the block VLANs/allow all other rules. Nowadays, I prefer to use the "destination invert" and basically create an "allow all" rule which just allows access to anything that's NOT a private network since I can combine 2 rules into a single, more elegant rule. My newer guides use that single rule instead (I find it easier to explain).
2. That is good to know (I'm assuming by "bridge" you are referring to using OPNsense purely as a firewall as opposed to a router/firewall?). I haven't used bridges in OPNsense so that may be helpful to those who do use them.
3. I actually do that on my firewall but I may not have mentioned it when I originally wrote the guide. I will mention it when I do updates! I'm also not quite sure which ICMP types should be or is safe to allow on the WAN because ICMP is more crucial to proper functionality of IPv6 than IPv4.

Thanks for the hint on bridged interfaces!

You can most certainly run both IPv4 and IPv6 on the same interfaces/networks. It is called “dual stack” since you’re using both IP stacks on your network. Not sure how long it will be until everything is IPv6. I’m wondering if it will happen in my lifetime or not. Hehe

Thanks, I’m glad you found them useful!

Yes, you can use the built in interface aliases. When you have several networks that is not very scalable because you have to update every interface’s firewall rules to include new networks that you add. I tend to prefer to block all private IP addresses but then allow DNS (and NTP, etc) before that block rule. The final block rule can be written to block all private IP addresses but allow all other addresses so you can have Internet access.

As for the possibility of dynamically changing IPv6 addresses, OPNsense recently added the ability to create dynamic IPv6 aliases which can be used in firewall rules but that is only for individual hosts since you have to select an interface. That certainly helps for individual access but doesn’t help with blocking all of the “private” IPv6 addresses unfortunately. If you have few networks you could use the built in addresses. However if you have several networks, using the full IPv6 address range as described in the guide is the best way to go even though it may mean you have to change it. At least it’s contained to a single alias so you only need to update it in one place. I have found that with Xfinity, that my IPv6 addresses don’t seem to change even after I swapped modems. I even kept my IPv4 address as well.

Sorry for the delay. I took a break for the holidays and I'm getting caught up. I took a look at that blog post. The nice thing about selecting "ICMP" in OPNsense in conjunction with selecting the protocol "IPv6" is that OPNsense is smart enough to select ICMPv6 so you shouldn't run into the situation described on that blog post. He was manually writing IP tables entries so it's a lot easier to shoot yourself in the foot.

One thing that I actually do now instead of how I mentioned it in the guide is to allow ALL ICMPv6 traffic instead of just the specific types that I listed. It reduces the number of firewall rules and it seems to get me a better IPv6 score because it no longer says that ICMPv6 is being filtered. Since IPv6 relies heavily on ICMP more than IPv4, it's probably best to enable all (or most) ICMPv6 on your network. There may be some attack vectors that could be exploited but I haven't really heard of that being a big issue for IPv6 users but if anyone comes across that information, I'd like to see it!

I’m not quite sure how to force it to work properly. It may depend on the ISP since they may do things differently.

However I think OPNsense had a few minor issues in the last few releases relating to DHCPv6. I think they are resolved now. I noticed on mine it would periodically stop running and drop the DHCPv6 addresses. I would try restarting it a few times and it would eventually work. I don’t see that happening in the latest versions, which is good.

IPv6 addresses are 128 bits long. IP addressing typically refers to addressing in bits so half of the IPv4 address is 64 bits long (https://en.m.wikipedia.org/... which is used as the network portion of the IPv6 address. The last 64 bits are used for assigning to devices within each network. Prefix delegation allows you to divide up the first half of the IPv6 address into multiple networks.

As for the block all private IP addresses rule— of devices are on the same network/VLAN, that rule will NOT block them because the network traffic does not need to be routed to other networks. If you have multiple interfaces that are NOT bridged together, they are treated as separate networks and WILL be blocked by that rule. However, you simply add rules above the block all rule to allow access to anything you want on other networks.

It’s easier to block access to all private networks to isolate each network when you have several separate networks/VLANs because you would have to go to each interface and block all of the other networks individually (using an alias would be beneficial) but if you did that and added a new network/VLAN, now you have to update all your rules again or update all your aliases. Blocking all private networks has the benefit of not accidentally allowing access to a new network (creating a potential security hole) depending on how you constructed your rules.

I hope this helps answer your questions.

So using prefix delegation options in the web interface don't work? You had to resort to editing a configuration file manually? I haven't experienced that issue with Comcast but it's possible that AT&T requires configuration that is not exposed via the web interface.