Route IPv6 Networks without NAT

Synopsis #

Native IPv6 routing assigns a globally routed prefix to each internal network. It does not require network address translation. This guide configures one OpenBSD router with a static upstream, one internal /64, rad(8) router advertisements, and an explicit Packet Filter policy.

The upstream provider must route a prefix to the OpenBSD system. A single on-link address or one SLAAC address does not imply that an additional LAN prefix is available. Confirm the routed-prefix size, next hop, and reverse-routing behavior before making changes.

Example Topology #

The example uses documentation prefixes:

Never deploy 2001:db8::/32; it exists only for documentation.

Configure Static IPv6 Addresses #

Add the upstream address to /etc/hostname.em0 without discarding existing IPv4 or link settings:

inet6 2001:db8:100::2 64

Configure /etc/hostname.em1:

inet6 2001:db8:200:10::1 64
up

Place the IPv6 default gateway on its own line in /etc/mygate, preserving any existing IPv4 gateway:

fe80::1%em0

Apply the complete network configuration with netstart(8) :

doas sh /etc/netstart

Confirm both addresses and the default route:

ifconfig em0 inet6
  # Confirm the WAN global and link-local addresses
ifconfig em1 inet6
  # Confirm the LAN /64
route -n show -inet6
  # Confirm connected routes and the IPv6 default route

Enable IPv6 Forwarding #

Add the following line to /etc/sysctl.conf:

net.inet6.ip6.forwarding=1

Apply it immediately with sysctl(8) :

doas sysctl net.inet6.ip6.forwarding=1

Enable IPv4 forwarding only if this host also routes IPv4 traffic.

Advertise the LAN Prefix #

rad(8) can advertise prefixes derived from the configured LAN interface. Limit it to interfaces that face managed client networks:

Create /etc/rad.conf with:

interface em1

Then validate and start the service:

doas rad -n && doas rcctl enable rad && doas rcctl start rad

The daemon must not advertise on the upstream interface. Review lifetimes, DNS information, and explicit prefixes against rad.conf(5) . The former rtadvd daemon is not part of current OpenBSD.

Add an IPv6 PF Policy #

IPv6 depends on ICMPv6 for neighbor discovery, path MTU discovery, error reporting, and address configuration. Do not apply an IPv4 policy that blocks ICMPv6 indiscriminately.

Integrate this minimal policy with the complete /etc/pf.conf:

wan = "em0"
lan = "em1"
lan6 = "2001:db8:200:10::/64"

block inet6 all
pass inet6 proto icmp6
pass in on $lan inet6 from $lan6 to any
pass out on $wan inet6 from $lan6 to any

This policy permits LAN-initiated traffic and its stateful replies. It does not publish inbound services from the Internet. Parse before loading:

doas pfctl -nf /etc/pf.conf
  # Check the complete policy without changing it
doas pfctl -f /etc/pf.conf
  # Load only after the syntax check succeeds

No nat-to rule is required. If internal addresses are not reachable from the Internet, correct provider routing, prefix allocation, local routes, or PF policy instead of adding NAT66.

Verify from a LAN Client #

After receiving a router advertisement, the client should have a global address in the LAN /64, a link-local address, and an IPv6 default route. Test in order:

ifconfig
  # Confirm the client global IPv6 address
route -n show -inet6
  # Confirm the default route learned from the router
ping6 2001:db8:200:10::1
  # Test the LAN router address
ping6 2001:db8:100::2
  # Test the router WAN address
traceroute6 openbsd.org
  # Test the routed Internet path

On the router, inspect neighbor discovery and packets:

ndp -a
  # Confirm the client neighbor entry
doas tcpdump -ni em1 icmp6
  # Observe advertisements and neighbor discovery
doas tcpdump -ni em0 ip6
  # Observe forwarded upstream traffic

Troubleshooting #

• No global client address usually indicates an advertisement, prefix, interface, or client-autoconfiguration problem.
• A client can reach the router but not the Internet when forwarding, PF, the default route, or upstream routing is wrong.
• Outbound packets visible on the WAN with no replies often indicate that the provider does not route the delegated prefix back to the router.
• Small transfers that work while larger ones stall can indicate broken ICMPv6 Packet Too Big delivery.
• DNS failure is separate from IPv6 routing. Test literal IPv6 addresses before changing resolver configuration.

See IPv6 at Scale for multi-prefix and routed-network design.