I moved over to VyOS Stream 2025Q2 today, using a pre-written configure.sh script. I’m left with working IPv4 but IPv6 refuses to work on the router itself (either via WAN or LAN). However, statically assigned LAN clients can talk to each other using addresses from my global scope static IPv6 prefix. Only the VyOS router can’t ping6 anyone (WAN or LAN).
On investigation, VyOS says that IPv4 is linkup but IPv6 is linkdown on the same interface. I don’t believe that should be possible? The cable can’t be both plugged in and working, and unplugged and passing zero traffic, at the same time?!
I have a Beelink EQ12 (Intel N100, Intel I225-V B3 NICs), connected to a Yuan Ley unmanaged 2.5G switch. My ISP is symmetric 2Gbps FTTP (no PPPoE) with static IP configuration. They provide me a /29 routed over a /31, and on IPv6 I have a static /48, of which I use a statically defined /64.
VyOS is passing IPv4 WAN to LAN and back again with no issue, and I’m getting 1.8Gbps with cake enabled! It’s just IPv6 refuses to work through it. I can’t ping6 the ISP gateway over v6 (the other half of a point to point link), LAN clients can’t ping6 to the VyOS IPv6 address or the ISP’s gateway (or any site on the Internet), but they can ping6 each other. The output on the router says:
vyos@vyos:\~$ show interfaces ethernet
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface IP Address S/L Description
--------- ---------- — -----------
eth1 185.154.146.115/31 u/u WAN Connection
185.154.147.136/32
185.154.147.137/32
185.154.147.138/32
185.154.147.139/32
185.154.147.140/32
185.154.147.141/32
185.154.147.142/32
185.154.147.143/32
2a0e:1d47::23/127
eth2 10.100.0.1/24 u/u LAN Network
2a0e:1d47:11::1/64
vyos@vyos:\~$ show ipv6 route
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIPng, O - OSPFv3, I - IS-IS, B - BGP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, \* - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
S>\* ::/0 \[1/0\] via 2a0e:1d47::22, eth1, weight 1, 00:06:03
C>\* 2a0e:1d47::22/127 is directly connected, eth1 linkdown, weight 1, 00:06:13
K \* 2a0e:1d47::22/127 \[0/256\] is directly connected, eth1 linkdown, weight 1, 00:06:17
L>\* 2a0e:1d47::23/128 is directly connected, eth1 linkdown, weight 1, 00:06:13
C>\* 2a0e:1d47:11::/64 is directly connected, eth2 linkdown, weight 1, 00:06:11
K \* 2a0e:1d47:11::/64 \[0/256\] is directly connected, eth2 linkdown, weight 1, 00:06:16
L>\* 2a0e:1d47:11::1/128 is directly connected, eth2 linkdown, weight 1, 00:06:11
C \* fe80::/64 is directly connected, eth2 linkdown, weight 1, 00:06:11
C \* fe80::/64 is directly connected, eth1 linkdown, weight 1, 00:06:12
C>\* fe80::/64 is directly connected, ifb0, weight 1, 00:06:18
vyos@vyos:\~$ show ip route
Codes: K - kernel route, C - connected, L - local, S - static,
R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
f - OpenFabric, t - Table-Direct,
> - selected route, \* - FIB route, q - queued, r - rejected, b - backup
t - trapped, o - offload failure
S>\* 0.0.0.0/0 \[1/0\] via 185.154.146.114, eth1, weight 1, 00:06:18
C>\* 10.100.0.0/24 is directly connected, eth2, weight 1, 00:06:27
L>\* 10.100.0.1/32 is directly connected, eth2, weight 1, 00:06:27
C>\* 185.154.146.114/31 is directly connected, eth1, weight 1, 00:06:29
L>\* 185.154.146.115/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.136/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.136/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.137/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.137/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.138/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.138/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.139/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.139/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.140/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.140/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.141/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.141/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.142/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.142/32 is directly connected, eth1, weight 1, 00:06:29
L \* 185.154.147.143/32 is directly connected, eth1, weight 1, 00:06:29
C>\* 185.154.147.143/32 is directly connected, eth1, weight 1, 00:06:29
So clearly, only ipv6 route thinks the links are down, which would explain the lack of passing IPv6 traffic! From my limited knowledge this shouldn’t be possible? The physical interface is the same, but show ip route says linkup while show ipv6 route says linkdown. I can share the full config if needed (zone based firewall, icmpv6 allowed), but it’s long!
Do you have any ideas please folks, before I give up and go back to OPNsense? I added the latest Rolling (October 1st 2025) and booted to that to rule out a quirk in Stream 2025Q2 but the issue remains. I can’t figure this out for the life of me. If it’s a bug it’s pointless me spending another 10 hours digging at the firewall config! Thanks in advance.