OpenBSD Handbook

    Theme
    • Part I. Install & Configure
      • Introduction to OpenBSD
      • Installing OpenBSD
      • The X Window System
      • Networking on OpenBSD
      • System Configuration
      • OpenBSD Basics
      • Managing Software: Packages and Ports
    • Part II. Daily Operations
      • OpenBSD Desktop Environments
      • Multimedia
      • Printing
      • Linux Compatibility
      • Windows Compatibility
      • Games
    • Part III. System Administration
      • Virtualization
      • Storage and File Systems
      • Updating and Upgrading
      • Localization
      • The OpenBSD Boot Process
      • Security
    • Part IV. Networking & Daemons
      • Services
        • Database
          • MariaDB
          • PostgreSQL
          • Redis
          • memcached
        • Directory
          • YP (NIS)
          • LDAP
        • File
          • NFS
          • Samba
        • FTP Services
          • ftpd
          • ProFTPD
          • vsftpd
          • Pure-FTPd
          • TFTP
        • Mail
          • OpenSMTPD Mail Server
          • Dovecot IMAP and POP3 Server
          • Postfix
          • Exim
          • Rspamd
        • Name
          • Unbound DNS Resolver
          • NSD Authoritative DNS Server
          • BIND DNS Server
        • Networking
          • OpenBGPD
          • rad
          • DHCP on OpenBSD
          • slaacd
        • Web
          • Apache HTTP Server
          • nginx Web Server
          • OpenBSD httpd Web Server
          • relayd Reverse Proxy
        • Logging
          • syslogd
        • Monitoring
          • SNMP
        • Remote Access
          • Audit OpenSSH
          • OpenSSH Server
        • File Synchronization
          • rsync
        • Messaging
          • RabbitMQ Message Broker
        • Time
          • NTP Time Synchronization
        • Load Balancing
          • Build Redundant Load-Balanced Gateways
          • Load Balance Services with NAT or DSR
          • Build an HA HTTPS Load Balancer
      • PF
        • pfctl cheat sheet
        • PF Anchors
        • PF Filter Rules
        • PF Forwarding
        • PF Lists and Macros
        • PF Load Balancing
        • PF Logging
        • PF NAT
        • PF Options
        • PF Policies
        • PF Shortcuts
        • PF Tables
      • Advanced Networking
        • High Availability and State Replication
        • Multi-WAN and Policy-Based Routing
        • VPN and Cryptographic Tunneling
        • Classic and Lightweight Tunnels
        • IPv6 at Scale
        • QoS and Traffic Shaping
        • MPLS and Label Distribution
        • Network Services at Scale
        • Virtualization and Host Networking
        • Large-Scale L2 and L3 Design
        • Telemetry, Logging, and Flow Export
        • Hardening and Operational Safety
        • Reference Architectures
        • Troubleshooting Playbooks
      • Serial Communication
    • Part V. Miscellaneous
      • Virtualization Cheat Sheet
      • OpenBSD Cheatsheet
      • How-to Guides
        • Installation and First Boot
          • Complete the First 30 Minutes After Installation
          • Check Hardware Compatibility Before Installing
          • Bootstrap Wi-Fi Firmware Without Ethernet
          • Run OpenBSD as a Virtual Machine Guest
          • Install OpenBSD on a VPS or Cloud Server
          • Install OpenBSD with Full-Disk Encryption
          • Dual-Boot OpenBSD on a UEFI System
          • Automate OpenBSD Installation with Autoinstall and PXE
        • Desktops and Laptops
          • Set Up OpenBSD as a Laptop or Workstation
          • Configure Laptop Power Management
          • Troubleshoot Web Browsers on OpenBSD
          • Use Plan 9 Tools on OpenBSD
          • Build a Minimal Desktop with suckless Tools
          • Install Z shell (zsh)
        • Networking and Remote Access
          • Create an Administrator Account with doas and SSH Keys
          • Configure Secure Remote Access with OpenSSH
          • Use FIDO Security Keys with OpenSSH
          • Configure Wi-Fi Roaming and Wired Failover
          • Troubleshoot PF, NAT, and Routing
          • Route Multiple VLANs with PF
          • Configure a Road-Warrior WireGuard VPN
          • Route IPv6 Networks without NAT
          • Test OpenBGPD with Two Providers
          • Unlock an Internal Service with an SSH Key
          • Build a Simple Router and Firewall
        • Servers and Services
          • Set Up WordPress on OpenBSD
          • Build a Mail Server with OpenSMTPD, Dovecot, and Rspamd
        • Security, Maintenance and Recovery
          • Establish a Conservative Security Baseline
          • Recover Access and Reset the Root Password
          • Collect OpenBSD Diagnostic Evidence
          • Troubleshoot Package Installation and Update Failures
          • Schedule Recurring Maintenance
          • Monitor an OpenBSD System
          • Back Up and Restore an OpenBSD System
          • Configure softraid RAID1
          • Recover an OpenBSD System That Does Not Boot
        • Building, Automation and Virtual Machines
          • Manage OpenBSD with Ansible
          • Build Third-Party Software from Ports
          • Build OpenBSD from Source
          • Plan a Docker Workload Migration to OpenBSD
      • OpenBSD for Linux Users
      • OpenBSD for FreeBSD Users
      • OpenBSD for macOS Users
    • OpenBSD FAQ
    • OpenBSD Architectures
      • OpenBSD Package Search
        • Synopsis
        • DHCP and Autoconfiguration Components in OpenBSD
        • Configuring SLAAC with slaacd(8)
          • Enabling SLAAC on an Interface
          • Managing slaacd at Runtime
        • Viewing Assigned IPv6 Addresses
        • DNS Configuration via RDNSS
        • Advertising IPv6 Prefixes
        • Disabling SLAAC on an Interface
        • Troubleshooting
          • Confirm Interface Addressing
          • Monitor Router Advertisements
          • Verify DNS Configuration

        slaacd

        Synopsis #

        OpenBSD supports Stateless Address Autoconfiguration (SLAAC), described in RFC 4862 . Hosts use Router Advertisements (RA) from local routers to set their IPv6 addresses automatically. SLAAC is OpenBSD’s default IPv6 client configuration method and does not need a central DHCPv6 server.

        The slaacd(8) daemon is responsible for receiving these advertisements and configuring IPv6 addresses, routes, and resolver settings accordingly.

        In typical OpenBSD networks, slaacd(8) is used in conjunction with rad(8) , which provides Router Advertisements on the server or router side.

        DHCP and Autoconfiguration Components in OpenBSD #

        The table below summarizes the primary components used for DHCP and autoconfiguration on OpenBSD, including both IPv4 and IPv6 support:

        ComponentRoleIP VersionIn BasePurpose
        dhcpleased(8)DHCP clientIPv4✔Assigns IPv4 address and DNS from DHCP server
        dhcpd(8)DHCP serverIPv4✔Assigns IPv4 addresses and configuration to clients
        slaacd(8)SLAAC client daemonIPv6✔Receives RA messages and configures interfaces
        rad(8)Router advertisement daemonIPv6✔Advertises IPv6 prefix and routing info
        dhcp6sDHCPv6 server (from ports)IPv6✘Provides stateful IPv6 configuration (rarely needed)

        For most IPv6 networks, slaacd(8) and rad(8) are sufficient and require no third-party software.

        Configuring SLAAC with slaacd(8) #

        The slaacd(8) daemon listens for Router Advertisements and configures:

        • IPv6 addresses (using the advertised prefix)
        • Default gateways
        • DNS resolver settings (if advertised via RDNSS)

        Enabling SLAAC on an Interface #

        To enable SLAAC on an interface, create or edit the corresponding /etc/hostname.if file to contain:

        inet6 autoconf
        

        For example, to enable SLAAC on em0:

        Add the line above to /etc/hostname.em0 without discarding existing IPv4 or link settings, then apply it:

        doas sh /etc/netstart em0
        

        The default-enabled slaacd daemon handles interfaces with the autoconfiguration flag. Setting that flag does not start a deliberately disabled daemon.

        Managing slaacd at Runtime #

        Although slaacd runs automatically for configured interfaces, it can be explicitly managed via rcctl(8):

        doas rcctl enable slaacd
        doas rcctl start slaacd
        doas rcctl check slaacd
        doas rcctl restart slaacd
        

        To inspect logs:

        doas tail -f /var/log/daemon
        

        Viewing Assigned IPv6 Addresses #

        After successful configuration, IPv6 addresses can be inspected with:

        ifconfig em0
        

        Example output:

        inet6 fe80::1%em0 prefixlen 64 scopeid 0x1
        inet6 2001:db8:abcd:1234::123 prefixlen 64 autoconf
        

        The autoconf keyword indicates that the address was assigned via SLAAC.

        DNS Configuration via RDNSS #

        slaacd sends advertised RDNSS information as resolver proposals. resolvd(8) merges them into /etc/resolv.conf alongside other proposals and user-edited lines. Do not make the file immutable; inspect the daemon and proposal state when DNS configuration is missing.

        Advertising IPv6 Prefixes #

        Router Advertisements must be present on the network for SLAAC to succeed. These are typically provided by rad(8), which must run on the default gateway or router.

        See the rad(8) chapter for full configuration details.

        Disabling SLAAC on an Interface #

        Replace inet6 autoconf with inet6 -autoconf in the interface file, preserving its other settings. Disable automatic configuration at runtime with:

        doas ifconfig em0 inet6 -autoconf
        

        For a static address, add an appropriate address and prefix length, for example inet6 2001:db8::123 64, and configure the actual IPv6 gateway. Merely deleting the file does not undo a running interface’s configuration.

        Troubleshooting #

        Confirm Interface Addressing #

        ifconfig em0
        

        Check for inet6 addresses with the autoconf tag.

        Monitor Router Advertisements #

        doas tcpdump -i em0 icmp6
        

        This will display incoming RA messages.

        Verify DNS Configuration #

        cat /etc/resolv.conf
        host openbsd.org
        

        If resolv.conf does not reflect expected settings, ensure that RDNSS is being advertised and the file is not protected.

        Report a bug
        • Synopsis
        • DHCP and Autoconfiguration Components in OpenBSD
        • Configuring SLAAC with slaacd(8)
          • Enabling SLAAC on an Interface
          • Managing slaacd at Runtime
        • Viewing Assigned IPv6 Addresses
        • DNS Configuration via RDNSS
        • Advertising IPv6 Prefixes
        • Disabling SLAAC on an Interface
        • Troubleshooting
          • Confirm Interface Addressing
          • Monitor Router Advertisements
          • Verify DNS Configuration