Netgate is offering COVID-19 aid for pfSense software users, learn more.
IPv6 DHCP Server and Router Advertisements¶
Automatic address assignment for IPv6 works quite a bit differently than IPv4. Even so, most of the DHCP options are similar, but there are notable differences in behavior in how things are assigned and also how items like the gateway are handed off to clients. Unless otherwise noted, options of the same name work the same for DHCP and DHCPv6. DHCPv6 and Router Advertisements (RA) are configured under Services > DHCPv6 Server/RA. Under that page there are two tabs: One for DHCPv6 Server and one for Router Advertisements.
DHCPv6 vs Stateless Address Autoconfiguration¶
There are a few clients that do not have support for DHCPv6. Some clients only support Stateless Address Autoconfiguration, or SLAAC for short. There is no way for the firewall to have direct knowledge of a list of hosts on the segment using SLAAC addresses, so for some environments it is much less desirable because of the lack of control and reporting of addresses. Consider address tracking and operating system support requirements when deciding how to allocate IPv6 addresses to clients on the network.
Many operating systems such as Windows, OS X, FreeBSD, Linux, and their cousins contain DHCPv6 clients that are capable of obtaining addresses as expected via DHCPv6. Some lightweight or mobile operating systems such as Android do not contain a DHCPv6 client and will only function on a local segment with IPv6 using SLAAC.
Router Advertisements (Or: “Where is the DHCPv6 gateway option”)¶
In IPv6, a router is located through Router Advertisement (RA) messages sent from routers instead of by DHCP; IPv6-enabled routers that support dynamic address assignment are expected to announce themselves on the network to all clients. As such, DHCPv6 does not include any gateway information. So clients can obtain their addresses from DHCPv6 or SLAAC, but unless they are statically configured, they always locate their next hop by using RA packets sent from available gateways.
To enable the RA service:
Navigate to Services > DHCPv6 Server/RA
Click the interface tab for the interface being configured
Click the Router Advertisements tab
Select a mode other than Disabled from the Router Mode drop-down list
The other options to control RA behavior may be set as needed for the network:
- Router Advertisement Modes
The modes for the RA daemon control the services offered by pfSense®, announce the firewall as an IPv6 router on the network, and direct clients on how to obtain addresses.
The RA daemon is disabled and will not run. IPv6 gateways must be entered manually on any client hosts.
- Router Only
This firewall will send out RA packets that advertise itself as an IPv6 router. DHCPv6 is disabled in this mode.
The firewall will send out RA packets and clients are directed to assign themselves IP addresses within the interface subnet using SLAAC. DHCPv6 is disabled in this mode.
The firewall will send out RA packets and addresses will only be assigned to clients using DHCPv6.
The firewall will send out RA packets and addresses can be assigned to clients by DHCPv6 or SLAAC.
- Stateless DHCP
The firewall will send out RA packets and addresses can be assigned to clients by SLAAC while providing additional information such as DNS and NTP from DHCPv6.
- Router Priority
If multiple IPv6 routers exist on the same network segment, they can indicate to clients in which order they should be used. If a high priority router becomes unavailable, clients will try a normal priority router, and finally a low priority router. Select either Low, Normal, or High from the list. If there is only one router on the network, use Normal.
- Default Valid Lifetime
Length of time, specified in seconds, that the advertised prefix will be valid. The default value is 86400 seconds (one day)
- Default Preferred Lifetime
Length of time, specified in seconds, that the client addresses generated in this prefix using SLAAC are valid. The default value is 86400 seconds (one day)
- RA Subnets
This section allows defining a list of subnets for which this firewall will send RA packets. Enter as many subnets as needed, each with an appropriate prefix (typically 64.). To create an additional row for another subnet, click Add.
- DNS Settings
Obtaining DNS information from RA messages is not universally supported, but for clients that do support it, using SLAAC to give an IP address and DNS from RA can do away with the need for using DHCPv6 entirely.
- DNS Servers
Enter up to three IP addresses for DNS Servers, or leave the fields blank to use the system default DNS servers or DNS Resolver/DNS forwarder if enabled.
- Domain Search List
Operates identically to the DHCP option of the same name.
- Use same settings as DHCPv6 server
When checked, these values will be pulled from the DHCPv6 options automatically.
The Range parameter works similarly to the same setting on IPv4 but it is worth mentioning again here due to the differences in IPv6 addressing.
Given the vast amount of space available inside even a /64, a good trick is to
craft a range that restricts hosts to use an easy to remember or recognize
range. For example, Inside a /64 such as
2001:db8:1:1::, set the DHCPv6
2001:db8:1:1::d:FFFF, using the
in the second to last section of the address as a sort of shorthand for “DHCP”.
That example range contains 2^16 (65,536) IPs, which is extremely large by
today’s IPv4 standards, but only a small portion of the whole /64.
DHCPv6 Prefix Delegation¶
Prefix delegation, covered earlier in DHCP6 Prefix Delegation and Track Interface, allows automatically dividing and allocating a block of IPv6 addresses to networks that will live behind other routers and firewall that reside downstream from pfSense (e.g. in the LAN, DMZ, etc). Most users acting in a client capacity will not need this and will likely leave it blank.
Prefix delegation can be used to hand out /64 chunks of a /48 to routers automatically, or any other combination, so long as the range is set on the boundaries of the desired delegation size. The downstream router obtains an IPv6 address and requests a delegation, and the server allocates one and dynamically adds a route so that it is reachable via the assigned DHCPv6 address given to the client.
The Prefix Delegation Range Sets the start and end of the delegation pool.
The range of IPv6 addresses specified here must be routed to this firewall by
upstream routers. For example, to allocate /60 networks to downstream firewalls
out of a given range, then one could specify
2001:db8:1111:FF00:: with a Prefix Delegation Size of 60. This allocates a
/60 (16 subnets of size /64) to each downstream firewall that requests a
delegation so that they can in turn use those for their LAN, VPNs, DMZ, etc.
Downstream firewalls can even further delegate their own allocation to routers
behind them. Note that in this example, 16 delegations would be possible. Adjust
the range and size as needed.
When crafting the values for the range and delegation size, keep in mind that
the range must start and end on boundaries that align with the desired prefix
size. In this /60 example, the range could not start or end on anything that has
a value in the places to the right of the second value in the fourth section of
the address, so it can start on
2001:db8:1111:F500:: but not
DHCPv6 Static Mappings¶
Static mappings on DHCPv6 work differently than IPv4. On IPv4, the mappings were performed using the MAC address of the PC. For IPv6, the designers decided that wasn’t good enough, since the MAC address of a PC could change, but still be the same PC.
Enter, the DHCP Unique Identifier, or DUID. The DUID of the host is generated by the operating system of the client and, in theory, will remain unique to that specific host until such time as the user forces a new DUID or the operating system is reinstalled. The DUID can range from 12 to 20 bytes, and varies depending on its type.
The DUID field on the static mapping page expects a DUID for a client PC in
a special format, represented by pairs of hexadecimal digits, separated by
colons, such as
How to obtain this DUID depends on the operating system. The easiest way is to
allow the PC to obtain a lease via DHCPv6, and then add an entry from the DHCPv6
Leases View (Status DHCPv6 Leases). In Windows, it can be found as DHCPv6 Client
DUID in the output of
On Windows, the DUID is generated at install time, so if a base image is used and workstations are cloned from there, they can all end up with the same DUID, and thus all end up pulling the same IPv6 address over DHCPv6.
Clear the DUID from the registry before making an image to clone, by issuing the following command:
reg delete HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters /f /v Dhcpv6DUID
That command may also be run on a working system to reset its DUID if needed.