# Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery

> Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.

- Canonical URL: https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:17+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.

## Potentially affected

This concerns pfSense WAN IPv6 configuration.

## DSE recommendation

DSE recommends obtaining the provider's address, delegated-prefix, and router-advertisement requirements before selecting interface options.

## Article

Receiving an IPv6 address does not mean DHCPv6 supplied the default gateway.

## Source facts

Netgate explains that DHCPv6 configures items such as the interface address, prefix length, and DNS servers, but the gateway is learned through router advertisements. IPv4 and IPv6 default gateways operate independently. Provider-specific prefix delegation and client requirements must come from the ISP rather than a generic example copied from another circuit.

Source: [Netgate — IPv6 Configuration Types](https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html).

## Applicability

This concerns pfSense WAN IPv6 configuration.

## DSE recommendation

DSE recommends obtaining the provider’s address, delegated-prefix, and router-advertisement requirements before selecting interface options. Diagnose address acquisition and default-route discovery as separate events. Record which internal interfaces track the delegated prefix and avoid selecting an upstream gateway on an ordinary internal LAN. Keep IPv6 acceptance criteria independent of IPv4 so an apparently successful dual-stack browser request does not conceal a broken protocol path. Collect address assignment and default-route evidence as separate acceptance items for the affected circuit. Ask the ISP to confirm the circuit’s delegation requirements in writing, and retain that answer with the interface design. A successful IPv4 test should not close an unresolved IPv6 router-advertisement or return-path finding.

## Verification

Inspect the obtained address, delegated prefix, router advertisement, and active IPv6 default route. From an approved client, test DNS and an intended IPv6 service explicitly. Repeat after the WAN reconnects and confirm that internal prefix tracking and return routing still match the provider’s documented arrangement.

## Official reference

[Netgate — IPv6 Configuration Types](https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html). Reviewed October 20, 2026.

## Primary reference

- Name: Netgate — IPv6 Configuration Types
- Authority: docs.netgate.com
- URL: https://docs.netgate.com/pfsense/en/latest/interfaces/configure-ipv6.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep pfSense DHCPv6 addressing separate from IPv6 gateway discovery,” DSE Security, https://update.dsesecurity.com/updates/keep-pfsense-dhcpv6-addressing-separate-from-ipv6-gateway-discovery/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.