Dynamic IPv6 PD rotation breaks LAN routing (Track Interface fails to update & radvd broadcasts stale prefix). Bug or misconfig?
I have a dual-stack setup where my ISP dynamically rotates my IPv6 Prefix Delegation (PD) over DHCPv6 on the WAN.
Note: The network data, issue details, and logs above are entirely real and captured from my local environment; AI was used solely to help format and organize the post cleanly.
The Setup:
- WAN: DHCPv6 (requesting prefix delegation).
- LAN IPv6 Configuration Type: Identity association
- Router Advertisements (LAN): SLAAC-only. I don't have any RA config under Services -> Router Advertisements. The current RA config is coming from DNSmasq DHCP ranges option. RA mode is ra-only.
The Issue: When the ISP rotates the prefix, rc.newwanipv6 triggers and WAN gets the new prefix. However, two things fail:
- Sync Problem: The LAN interface alias does not immediately update to the new prefix. It gets stuck on the old
/64. - SLAAC Stale Lifetimes:
radvdkeeps broadcasting the old prefix. Since OPNsense defaults to 24-hour Valid/Preferred lifetimes and doesn't explicitly send a deprecation signal (Preferred Lifetime = 0), all my local SLAAC clients retain unroutable IPs and IPv6 routing blackholes until I manually intervene.
Interfaces -> Overview output:
See that IPv6 on WAN and LAN is different 1d32 vs 1d36
Here is the rdisc6 output from a Debian client on the LAN after the WAN PD changed. Notice the stale prefix still being advertised with a full 24h lifetime:
Plaintext
Prefix : 2a00:1d36:4f6b:3100::/64 (Old Prefix)
On-link : Yes
Autonomous address conf.: Yes
Valid time : 86400 seconds
Pref. time : 86400 seconds
My Workaround: Couldn't find. Rebooting the Opnsense, disable and re-enable IPv6 is not a solution.
My Question: Am I missing a specific settings, should I open a bug report for this?
Thanks in advance.