{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "item": { "id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "slug": "keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery", "url": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery.md", "json": "https://update.dsesecurity.com/api/v1/posts/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/" }, "title": "Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery", "summary": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:17+00:00", "modified_at": "2026-10-20T18:34:35+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 243, "potentially_affected": "This concerns pfSense WAN IPv6 configuration.", "dse_recommendation": "DSE recommends obtaining the provider's address, delegated-prefix, and router-advertisement requirements before selecting interface options.", "primary_source": { "name": "Netgate — IPv6 Configuration Types", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html", "published_on": null, "authority": "docs.netgate.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.

\n

Source facts

\n

Netgate explains that DHCPv6 configures items such as the interface address, prefix length, and DNS servers, but the gateway is learned through router advertisements. IPv4 and IPv6 default gateways operate independently. Provider-specific prefix delegation and client requirements must come from the ISP rather than a generic example copied from another circuit.

\n

Source: Netgate — IPv6 Configuration Types.

\n

Applicability

\n

This concerns pfSense WAN IPv6 configuration.

\n

DSE recommendation

\n

DSE recommends obtaining the provider’s address, delegated-prefix, and router-advertisement requirements before selecting interface options. Diagnose address acquisition and default-route discovery as separate events. Record which internal interfaces track the delegated prefix and avoid selecting an upstream gateway on an ordinary internal LAN. Keep IPv6 acceptance criteria independent of IPv4 so an apparently successful dual-stack browser request does not conceal a broken protocol path. Collect address assignment and default-route evidence as separate acceptance items for the affected circuit. Ask the ISP to confirm the circuit’s delegation requirements in writing, and retain that answer with the interface design. A successful IPv4 test should not close an unresolved IPv6 router-advertisement or return-path finding.

\n

Verification

\n

Inspect the obtained address, delegated prefix, router advertisement, and active IPv6 default route. From an approved client, test DNS and an intended IPv6 service explicitly. Repeat after the WAN reconnects and confirm that internal prefix tracking and return routing still match the provider’s documented arrangement.

\n

Official reference

\n

Netgate — IPv6 Configuration Types. Reviewed October 20, 2026.

", "content_text": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.\nSource facts\nNetgate explains that DHCPv6 configures items such as the interface address, prefix length, and DNS servers, but the gateway is learned through router advertisements. IPv4 and IPv6 default gateways operate independently. Provider-specific prefix delegation and client requirements must come from the ISP rather than a generic example copied from another circuit.\nSource: Netgate — IPv6 Configuration Types.\nApplicability\nThis concerns pfSense WAN IPv6 configuration.\nDSE recommendation\nDSE recommends obtaining the provider’s address, delegated-prefix, and router-advertisement requirements before selecting interface options. Diagnose address acquisition and default-route discovery as separate events. Record which internal interfaces track the delegated prefix and avoid selecting an upstream gateway on an ordinary internal LAN. Keep IPv6 acceptance criteria independent of IPv4 so an apparently successful dual-stack browser request does not conceal a broken protocol path. Collect address assignment and default-route evidence as separate acceptance items for the affected circuit. Ask the ISP to confirm the circuit’s delegation requirements in writing, and retain that answer with the interface design. A successful IPv4 test should not close an unresolved IPv6 router-advertisement or return-path finding.\nVerification\nInspect the obtained address, delegated prefix, router advertisement, and active IPv6 default route. From an approved client, test DNS and an intended IPv6 service explicitly. Repeat after the WAN reconnects and confirm that internal prefix tracking and return routing still match the provider’s documented arrangement.\nOfficial reference\nNetgate — IPv6 Configuration Types. Reviewed October 20, 2026.", "content_markdown": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.\n\n## Source facts\n\nNetgate explains that DHCPv6 configures items such as the interface address, prefix length, and DNS servers, but the gateway is learned through router advertisements. IPv4 and IPv6 default gateways operate independently. Provider-specific prefix delegation and client requirements must come from the ISP rather than a generic example copied from another circuit.\n\nSource: [Netgate — IPv6 Configuration Types](https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html).\n\n## Applicability\n\nThis concerns pfSense WAN IPv6 configuration.\n\n## DSE recommendation\n\nDSE recommends obtaining the provider’s address, delegated-prefix, and router-advertisement requirements before selecting interface options. Diagnose address acquisition and default-route discovery as separate events. Record which internal interfaces track the delegated prefix and avoid selecting an upstream gateway on an ordinary internal LAN. Keep IPv6 acceptance criteria independent of IPv4 so an apparently successful dual-stack browser request does not conceal a broken protocol path. Collect address assignment and default-route evidence as separate acceptance items for the affected circuit. Ask the ISP to confirm the circuit’s delegation requirements in writing, and retain that answer with the interface design. A successful IPv4 test should not close an unresolved IPv6 router-advertisement or return-path finding.\n\n## Verification\n\nInspect the obtained address, delegated prefix, router advertisement, and active IPv6 default route. From an approved client, test DNS and an intended IPv6 service explicitly. Repeat after the WAN reconnects and confirm that internal prefix tracking and return routing still match the provider’s documented arrangement.\n\n## Official reference\n\n[Netgate — IPv6 Configuration Types](https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "url": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery", "item": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/#article", "identifier": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "url": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/", "headline": "Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery", "description": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.", "abstract": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.", "articleBody": "Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.\nSource facts\nNetgate explains that DHCPv6 configures items such as the interface address, prefix length, and DNS servers, but the gateway is learned through router advertisements. IPv4 and IPv6 default gateways operate independently. Provider-specific prefix delegation and client requirements must come from the ISP rather than a generic example copied from another circuit.\nSource: Netgate — IPv6 Configuration Types.\nApplicability\nThis concerns pfSense WAN IPv6 configuration.\nDSE recommendation\nDSE recommends obtaining the provider’s address, delegated-prefix, and router-advertisement requirements before selecting interface options. Diagnose address acquisition and default-route discovery as separate events. Record which internal interfaces track the delegated prefix and avoid selecting an upstream gateway on an ordinary internal LAN. Keep IPv6 acceptance criteria independent of IPv4 so an apparently successful dual-stack browser request does not conceal a broken protocol path. Collect address assignment and default-route evidence as separate acceptance items for the affected circuit. Ask the ISP to confirm the circuit’s delegation requirements in writing, and retain that answer with the interface design. A successful IPv4 test should not close an unresolved IPv6 router-advertisement or return-path finding.\nVerification\nInspect the obtained address, delegated prefix, router advertisement, and active IPv6 default route. From an approved client, test DNS and an intended IPv6 service explicitly. Repeat after the WAN reconnects and confirm that internal prefix tracking and return routing still match the provider’s documented arrangement.\nOfficial reference\nNetgate — IPv6 Configuration Types. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:17+00:00", "dateModified": "2026-10-20T18:34:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 243, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Netgate — IPv6 Configuration Types", "url": "https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html" } } ] } }