Route IPv6 Networks without NAT

Synopsis #

Native IPv6 routing assigns a globally routed prefix to each internal network. It does not require network address translation. This guide configures one OpenBSD router with a static upstream, one internal /64, rtadvd(8) router advertisements, and an explicit Packet Filter policy.

The upstream provider must route a prefix to the OpenBSD system. A single on-link address or one SLAAC address does not imply that an additional LAN prefix is available. Confirm the routed-prefix size, next hop, and reverse-routing behavior before making changes.

Example Topology #

The example uses documentation prefixes:

Never deploy 2001:db8::/32; it exists only for documentation.

Configure Static IPv6 Addresses #

Add the upstream address to /etc/hostname.em0 without discarding existing IPv4 or link settings:

inet6 2001:db8:100::2 64

Configure /etc/hostname.em1:

inet6 2001:db8:200:10::1 64
up

Place the IPv6 default gateway on its own line in /etc/mygate, preserving any existing IPv4 gateway:

fe80::1%em0

Apply the complete network configuration with netstart(8) :

# sh /etc/netstart

Confirm both addresses and the default route:

$ ifconfig em0 inet6
  # Confirm the WAN global and link-local addresses
$ ifconfig em1 inet6
  # Confirm the LAN /64
$ route -n show -inet6
  # Confirm connected routes and the IPv6 default route

Enable IPv6 Forwarding #

Add the following line to /etc/sysctl.conf:

net.inet6.ip6.forwarding=1

Apply it immediately with sysctl(8) :

# sysctl net.inet6.ip6.forwarding=1

Do not enable IPv4 forwarding unless the host also has an intentional IPv4 routing policy.

Advertise the LAN Prefix #

rtadvd(8) can advertise prefixes derived from the configured LAN interface. Limit it to interfaces that face managed client networks:

# rcctl set rtadvd flags em1
  # Advertise only on the LAN interface
# rcctl enable rtadvd
  # Start the daemon during boot
# rcctl start rtadvd
  # Begin sending router advertisements

The daemon must not advertise on the upstream interface. More complex lifetimes, DNS information, or prefix behavior require an explicit /etc/rtadvd.conf reviewed against rtadvd.conf(5) .

Add an IPv6 PF Policy #

IPv6 depends on ICMPv6 for neighbor discovery, path MTU discovery, error reporting, and address configuration. Do not apply an IPv4 policy that blocks ICMPv6 indiscriminately.

Integrate this minimal policy with the complete /etc/pf.conf:

wan = "em0"
lan = "em1"
lan6 = "2001:db8:200:10::/64"

block inet6 all
pass inet6 proto icmp6
pass in on $lan inet6 from $lan6 to any
pass out on $wan inet6 from $lan6 to any

This policy permits LAN-initiated traffic and its stateful replies. It does not publish inbound services from the Internet. Parse before loading:

# pfctl -nf /etc/pf.conf
  # Check the complete policy without changing it
# pfctl -f /etc/pf.conf
  # Load only after the syntax check succeeds

No nat-to rule is required. If internal addresses are not reachable from the Internet, correct provider routing, prefix allocation, local routes, or PF policy instead of adding NAT66.

Verify from a LAN Client #

After receiving a router advertisement, the client should have a global address in the LAN /64, a link-local address, and an IPv6 default route. Test in order:

$ ifconfig
  # Confirm the client global IPv6 address
$ route -n show -inet6
  # Confirm the default route learned from the router
$ ping6 2001:db8:200:10::1
  # Test the LAN router address
$ ping6 2001:db8:100::2
  # Test the router WAN address
$ traceroute6 openbsd.org
  # Test the routed Internet path

On the router, inspect neighbor discovery and packets:

$ ndp -a
  # Confirm the client neighbor entry
# tcpdump -ni em1 icmp6
  # Observe advertisements and neighbor discovery
# tcpdump -ni em0 ip6
  # Observe forwarded upstream traffic

Troubleshooting Boundaries #

• No global client address usually indicates an advertisement, prefix, interface, or client-autoconfiguration problem.
• A client can reach the router but not the Internet when forwarding, PF, the default route, or upstream routing is wrong.
• Outbound packets visible on the WAN with no replies often indicate that the provider does not route the delegated prefix back to the router.
• Small transfers that work while larger ones stall can indicate broken ICMPv6 Packet Too Big delivery.
• DNS failure is separate from IPv6 routing. Test literal IPv6 addresses before changing resolver configuration.

See IPv6 at Scale for multi-prefix and routed-network design.