Dhcpv6 client on WAN not getting default ipv6 route

General questions
,
1

My home router is not getting a default ipv6 route configured on my WAN interface, even though it is still receiving its IPv6 address via DHCPv6. I’m 99% sure this used to be working on a previous nightly rolling version, and I don’t believe I’ve changed any config that would break it.

I am running VyOS 2025.09.01-0023-rolling.

Interface configuration:

# show int ethernet eth1
 address dhcp
 address dhcpv6
 description WAN
 dhcpv6-options {
     pd 0 {
         interface eth7.20 {
             address 1
             sla-id 32
         }
         length 48
     }
 }
 hw-id 3c:ec:ef:41:a2:25
 offload {
     gro
     gso
     sg
     tso
 }

Firewall configuration:

# show firewall ipv6 name WAN-LOCAL-v6
 default-action drop
 default-log
 rule 1 {
     action accept
     protocol ipv6-icmp
 }
 rule 2 {
     action accept
     description "Allow DHCPv6 response from ISP"
     destination {
         port 546
     }
     protocol udp
     source {
         port 547
     }
 }

# show firewall ipv6 name LOCAL-WAN-v6
 default-action accept

Interface status:

$ show int | strip-private
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address                                   MAC                VRF        MTU  S/L    Description
-----------  -------------------------------------------  -----------------  -------  -----  -----  ---------------
eth0         -                                            xx:xx:xx:xx:xx:24  default   1500  A/D
eth1         xxx.xxx.133.141/22                            xx:xx:xx:xx:xx:25  default   1500  u/u    WAN
             xxxx:xxxx:ffff:1528:5336:118e:bf12:f431/128
eth2         -                                            xx:xx:xx:xx:xx:26  default   1500  u/D
eth3         -                                            xx:xx:xx:xx:xx:27  default   1500  u/D
eth4         -                                            xx:xx:xx:xx:xx:3c  default   1500  u/D
eth5         -                                            xx:xx:xx:xx:xx:3d  default   1500  u/D
eth6         -                                            xx:xx:xx:xx:xx:3e  default   1500  u/D
eth7         -                                            xx:xx:xx:xx:xx:3f  default   1500  u/u
eth7.10      xxx.xxx.10.1/24                              xx:xx:xx:xx:xx:3f  default   1500  u/u    MGMT
eth7.20      xxx.xxx.20.1/24                              xx:xx:xx:xx:xx:3f  default   1500  u/u    LAN
             xxxx:xxxx:9532:20::1/64
eth7.30      xxx.xxx.30.1/24                              xx:xx:xx:xx:xx:3f  default   1500  u/u    IOT
eth7.40      xxx.xxx.40.1/24                              xx:xx:xx:xx:xx:3f  default   1500  u/u    CCTV
lo           xxx.xxx.0.1/8                                  xx:xx:xx:xx:xx:00  default  65536  u/u
             ::1/128
veth0        -                                            xx:xx:xx:xx:xx:89  default   1500  u/u
wg0          xxx.xxx.99.1/24                              n/a                default   1420  u/u    VPN_1
wg1          xxx.xxx.199.2/24                             n/a                default   1420  u/u    VPN_2
wg2          xxx.xxx.189.2/24                             n/a                default   1420  u/u    VPN_3

Routing status:

$ ip -6 route show | strip-private
xxxx:xxxx:9532:20::/64 dev eth7.20 proto kernel metric 256 pref medium
xxxx:xxxx:ffff:1528:5336:118e:bf12:f431 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev lo proto kernel metric 256 pref medium
fe80::/64 dev eth3 proto kernel metric 256 dead linkdown pref medium
fe80::/64 dev eth2 proto kernel metric 256 dead linkdown pref medium
fe80::/64 dev eth7 proto kernel metric 256 pref medium
fe80::/64 dev eth7.10 proto kernel metric 256 pref medium
fe80::/64 dev eth7.20 proto kernel metric 256 pref medium
fe80::/64 dev eth7.30 proto kernel metric 256 pref medium
fe80::/64 dev eth7.40 proto kernel metric 256 pref medium
fe80::/64 dev eth1 proto kernel metric 256 pref medium
fe80::/64 dev eth6 proto kernel metric 256 dead linkdown pref medium
fe80::/64 dev eth5 proto kernel metric 256 dead linkdown pref medium
fe80::/64 dev eth4 proto kernel metric 256 dead linkdown pref medium
fe80::/64 dev wg2 proto kernel metric 256 pref medium
fe80::/64 dev wg1 proto kernel metric 256 pref medium
fe80::/64 dev wg0 proto kernel metric 256 pref medium
fe80::/64 dev pod-containers proto kernel metric 256 pref medium
2

Check this task T7646

Probably your case

3

This is separate from your question, but just to make sure, regarding your firewall config. You are applying the named chains to the input/output/forward chains correct?

4

Thanks - indeed that was the issue - changing my WAN interface config to the below has solved my issue:

# show int ethernet eth1
 address dhcp
 address dhcpv6
 description WAN
 dhcpv6-options {
     pd 0 {
         interface eth7.20 {
             address 1
             sla-id 32
         }
         length 48
     }
 }
 hw-id 3c:ec:ef:41:a2:25
 ipv6 {
     address {
         autoconf
     }
 }
 offload {
     gro
     gso
     sg
     tso
 }
5

Thanks for double checking - yes I am applying the named chains - by using the zone based firewall method described in the docs here: Zone Based Firewall — VyOS 1.5.x (circinus) documentation