The plan
Number a site from an ISP's /48 on VyOS: WAN and blackhole routes, SLAAC with Router Advertisements, handing a /56 to a downstream router statically and with DHCPv6 prefix delegation, and the forward firewall IPv6 needs because there's no NAT. Every output comes from a real two-router VyOS lab.
By the end you will be able to:
- Plan an IPv6 site from a /48: /64 LANs and /56 handovers
- Configure VyOS WAN addressing, a default route and a blackhole for your prefix
- Use Router Advertisements so clients configure themselves with SLAAC, and read an RA with rdisc6
- Hand a prefix to a downstream router with static routes, and recognise the missing-return-route failure
- Delegate prefixes automatically with DHCPv6-PD, and explain why the downstream router still needs a blackhole
- Write an IPv6 forward firewall that keeps ICMPv6 working
Prerequisites: Setting up VyOS with NAT
IPv6 on a router is mostly the same job as IPv4: addresses on interfaces, a default route, and routes for the networks behind you. Three things are different, and they shape everything in this lesson:
- There's plenty of address space, so you plan in /64s. Every LAN is a /64, the size SLAAC (below) needs, however few hosts it has. An ISP typically gives a site a /48 (65,536 /64s) or a /56 (256), and you hand out pieces of it.
- Hosts configure themselves. Instead of DHCP handing out addresses, the router sends Router Advertisements (RA): "this is the prefix for this LAN, I'm a default router, here's a DNS server." Each host builds its own address from the prefix. This is Stateless Address Autoconfiguration (SLAAC).
- There's no NAT. Every host has a globally routable address, so routing has to be right in both directions, and a firewall decides what may come in (see the NAT lesson's "NAT isn't a firewall").
This lab's ISP has given us 2001:db8:1000::/48. The plan:
| Prefix | Used for |
|---|---|
| 2001:db8:ffff:1::/64 | The WAN link to the ISP (the ISP's addressing, not ours) |
| 2001:db8:1000:1::/64 | LAN1, on R1 |
| 2001:db8:1000:ff::/64 | The transit link from R1 to R2 |
| 2001:db8:1000:100::/56 | Handed to R2 statically, for its own LANs |
| 2001:db8:1000:200::/56 | Handed to R2 dynamically, with DHCPv6 prefix delegation |
Using /56 boundaries for each downstream router (rather than single /64s) means R2 can add up to 256 LANs without asking R1 for anything.
The lab runs two VyOS routers (rolling 2026.10.16) as virtual machines, plus Linux containers for the ISP, a server "on the internet" at 2001:db8:f000::10, and a client on each LAN. The clients have no static IPv6 configuration at all: everything they know comes from VyOS. Every output is copied from that lab.
- The ISP routes the /48 to R1. R1 has a default route to the ISP and a blackhole for the whole /48, so any part it hasn't deployed is dropped rather than bounced back.
- Router Advertisements on LAN1. R1 advertises 2001:db8:1000:1::/64 and a DNS server. client1 builds its own address and uses R1's link-local address as its default gateway.
- Static handover to R2. R1 routes 2001:db8:1000:100::/56 to R2 across the transit link. R2 numbers LAN2 from it, with its own RAs and its own blackhole for the /56.
- DHCPv6 prefix delegation. R2 asks R1 for a prefix. R1 delegates 2001:db8:1000:200::/56 from its pool and installs a route to it automatically.
- No NAT: a forward firewall instead. Every client has a public address. R1 lets replies and ICMPv6 in, lets both LANs out, and drops everything else arriving from the internet.
Check your understanding
Why does every LAN get a /64, even one with three hosts?
- Because SLAAC builds addresses from a /64 prefix plus a 64-bit interface identifier
- Because routers can't route anything smaller
- To make room for NAT
- Because the ISP requires it