Troubleshooting
IPv6 problems on a router usually come down to three things: the prefix never arrived, devices never got an address, or ICMPv6 is being dropped somewhere.
When ICMPv6 is dropped
With the ICMPv6 rule removed from the router's input chain, the staff PC can't reach anything beyond its own VLAN. It needs the router's MAC address and asks with a neighbour solicitation, which the router drops; the PC's neighbour table shows the router as INCOMPLETE. Putting the rule back fixes it straight away. The same mistake on the WAN is what stopped the prefix arriving in the first place.
Symptoms and causes
| Symptom | Check | Likely cause |
|---|---|---|
| No delegated prefix; DHCPv6 solicits leave, nothing comes back | tcpdump -ni eth0 "udp port 546 or 547 or icmp6" | Neighbour solicitations from the ISP dropped by the input chain: allow ICMPv6 |
| ISP's advertise arrives, still no prefix | Input chain counter | DHCPv6 replies (UDP 546 from link-local) dropped |
| Prefix delegated, VLAN has no IPv6 address | networkctl status <vlan> | DHCPPrefixDelegation=yes missing, or SubnetId outside the delegated size |
| VLAN has an address, devices don't | tcpdump -vni <vlan> "icmp6 and ip6[40] == 134" | No RAs: IPv6SendRA=yes missing |
| Devices have addresses, no internet | sysctl net.ipv6.conf.all.forwarding | IPv6 forwarding off |
| Devices can't reach the router itself | ip -6 neigh on the device: router INCOMPLETE | Neighbour discovery dropped by the input chain |
| Big transfers hang, small ones work | ping -6 -s 1400 -M do … | packet-too-big dropped somewhere: never block it |
| Internet reaches office devices directly | nft list chain inet filter forward | No forward policy: with IPv6 there's no NAT to hide behind |
Cheat sheets: nftables, Network error messages explained.
root@router:~# sed '/icmpv6 type/,/parameter-problem } accept/d' /etc/nftables.conf > /root/no-icmpv6.conf && grep -c icmpv6 /root/no-icmpv6.conf; nft -f /root/no-icmpv6.conf && echo loaded
0
loaded
root@staff:~# ip -6 neigh flush dev eth0.10; ping -6 -c 2 -W 1 2001:db8:e::10 | tail -2; ip -6 neigh show dev eth0.10
2 packets transmitted, 0 received, 100% packet loss, time 1023ms
fe80::ff:fe00:101 INCOMPLETE
root@router:~# systemctl reload nftables && nft list chain inet filter input | grep -c icmpv6
1
root@staff:~# ping -6 -c 2 -W 1 2001:db8:e::10 | tail -2
2 packets transmitted, 1 received, +1 errors, 50% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.227/0.227/0.227/0.000 ms
root@staff:~# ping -6 -c 2 -W 1 2001:db8:e::10 | tail -2; ip -6 neigh show dev eth0.10
2 packets transmitted, 2 received, 0% packet loss, time 1056ms
rtt min/avg/max/mdev = 0.075/0.083/0.092/0.008 ms
fe80::ff:fe00:101 lladdr 02:00:00:00:01:01 router REACHABLE - Lines 1–3: A copy of the ruleset without the ICMPv6 rule, loaded for the test.
- Lines 5–8: The PC can't find the router: its neighbour entry stays INCOMPLETE.
- Lines 10–11: The real ruleset reloaded.
- Lines 13–15: The first ping still meets the stale entry…
- Lines 17–20: …and then everything works, with the router REACHABLE.