DHCPv6 Server in VyOS

DHCPv6 (Dynamic Host Configuration Protocol for IPv6) is a protocol for automatically configuring IPv6 addresses and network parameters for clients. VyOS provides a full-featured DHCPv6 server for centralized management of IPv6 addressing on the network.

Overview

DHCPv6 is used for:

Automatic IPv6 address assignment: Centralized address management
Parameter configuration: DNS servers, search domain, NTP servers
Static reservations: Fixed addresses for servers and equipment
Prefix delegation: Delegating prefixes to routers (DHCPv6-PD)
Integration with SLAAC: Working together with Router Advertisement

DHCPv6 vs SLAAC

Feature	DHCPv6	SLAAC (Stateless)
Address assignment	Stateful (server controls)	Stateless (client generates)
DNS servers	Yes	Via RDNSS (RA)
Search domain	Yes	Via DNSSL (RA)
Centralized management	Yes	Limited
Static reservations	Yes	No
Client tracking	Yes (lease tracking)	No

Operating modes:

Stateful DHCPv6: Full address management (managed flag in RA)
Stateless DHCPv6: Parameters only, addresses via SLAAC (other-config flag)
Hybrid: SLAAC for addresses + DHCPv6 for parameters

Basic Configuration

Simple DHCPv6 server

# Shared network for DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200

# DNS servers
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844

# Search domain
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com

# Apply on interface
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save

Router Advertisement for managed mode

DHCPv6 requires Router Advertisement to inform clients:

# Router Advertisement on the interface
set service router-advert interface eth1 prefix 2001:db8:1::/64

# Managed flag (clients use DHCPv6 for addresses)
set service router-advert interface eth1 managed-flag

# Other-config flag (clients use DHCPv6 for parameters)
set service router-advert interface eth1 other-config-flag

commit
save

Static reservation (static mapping)

# Static reservation by DUID
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 identifier 00:01:00:01:12:34:56:78:ab:cd:ef:01:23:45
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 ipv6-address 2001:db8:1::10

commit
save

Note: DHCPv6 uses a DUID (DHCP Unique Identifier) instead of a MAC address.

Advanced Configuration

Stateless DHCPv6 (parameters only)

# DHCPv6 for parameters (without addresses)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com

# Do NOT set address-range (clients get addresses via SLAAC)

set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement without managed flag
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 other-config-flag  # Parameters only

commit
save

DHCPv6 Prefix Delegation (PD)

Prefix Delegation allows delegating IPv6 prefixes to downstream routers:

# Prefix delegation pool
set service dhcpv6-server shared-network-name LAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56

# Apply on interface
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save

The downstream router will request a /56 prefix from the pool 2001:db8:1000::/52.

Multiple shared networks

# LAN 1
set service dhcpv6-server shared-network-name LAN1 subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN1 subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN1 interface eth1

# LAN 2
set service dhcpv6-server shared-network-name LAN2 subnet 2001:db8:2::/64 address-range start 2001:db8:2::100 stop 2001:db8:2::200
set service dhcpv6-server shared-network-name LAN2 subnet 2001:db8:2::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN2 interface eth2

commit
save

Lease time configuration

# Lease time configuration
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 86400  # 24 hours
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time minimum 3600   # 1 hour
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time maximum 172800 # 48 hours

commit
save

NTP and SIP servers

# NTP servers via DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 nis-server 2001:db8:1::50

# SIP servers (for VoIP)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 sip-server-address 2001:db8:1::60

commit
save

Vendor options

# Vendor-specific options
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 vendor-option cisco option 1 value 'option-value'

commit
save

Configuration Examples

Example 1: Basic managed DHCPv6

# DHCPv6 server
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 managed-flag
set service router-advert interface eth1 other-config-flag

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

commit
save

Example 2: Stateless DHCPv6 + SLAAC

# DHCPv6 for parameters only (without addresses)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement for SLAAC (without managed flag)
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 other-config-flag  # Parameters only via DHCPv6

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

commit
save

Example 3: Static reservations for servers

# DHCPv6 pool
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN interface eth1

# Static reservations
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server identifier 00:01:00:01:aa:bb:cc:dd:11:22:33:44:55:66
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server ipv6-address 2001:db8:1::10

set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping db-server identifier 00:01:00:01:aa:bb:cc:dd:77:88:99:aa:bb:cc
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping db-server ipv6-address 2001:db8:1::11

set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping dns-server identifier 00:01:00:01:aa:bb:cc:dd:dd:ee:ff:00:11:22
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping dns-server ipv6-address 2001:db8:1::53

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 managed-flag

commit
save

Example 4: DHCPv6 Prefix Delegation for branch offices

Head office (delegates prefixes):

# DHCPv6 with Prefix Delegation
set service dhcpv6-server shared-network-name WAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56
set service dhcpv6-server shared-network-name WAN interface eth0

# Router Advertisement on WAN
set service router-advert interface eth0 prefix 2001:db8::/64

# IPv6 on the WAN interface
set interfaces ethernet eth0 address 2001:db8::1/64

commit
save

Branch office (requests prefix delegation):

# DHCPv6 client to obtain a prefix
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 address 1
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 sla-id 0

# Router Advertisement on LAN for clients
set service router-advert interface eth1 prefix ::/64  # The delegated prefix will be used

commit
save

Example 5: Multiple VLANs with DHCPv6

# VLAN 10 - Management
set interfaces ethernet eth1 vif 10 address 2001:db8:10::1/64
set service dhcpv6-server shared-network-name MGMT subnet 2001:db8:10::/64 address-range start 2001:db8:10::100 stop 2001:db8:10::150
set service dhcpv6-server shared-network-name MGMT subnet 2001:db8:10::/64 name-server 2001:db8:10::53
set service dhcpv6-server shared-network-name MGMT interface eth1.10

set service router-advert interface eth1.10 prefix 2001:db8:10::/64
set service router-advert interface eth1.10 managed-flag

# VLAN 20 - Users
set interfaces ethernet eth1 vif 20 address 2001:db8:20::1/64
set service dhcpv6-server shared-network-name USERS subnet 2001:db8:20::/64 address-range start 2001:db8:20::100 stop 2001:db8:20::500
set service dhcpv6-server shared-network-name USERS subnet 2001:db8:20::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name USERS interface eth1.20

set service router-advert interface eth1.20 prefix 2001:db8:20::/64
set service router-advert interface eth1.20 managed-flag

# VLAN 30 - Guest (stateless)
set interfaces ethernet eth1 vif 30 address 2001:db8:30::1/64
set service dhcpv6-server shared-network-name GUEST subnet 2001:db8:30::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name GUEST interface eth1.30

set service router-advert interface eth1.30 prefix 2001:db8:30::/64
set service router-advert interface eth1.30 other-config-flag  # Stateless

commit
save

Example 6: DHCPv6 with VRF

# VRF for isolation
set vrf name CUSTOMER-A table 100

# Interface in VRF
set interfaces ethernet eth1 vrf CUSTOMER-A
set interfaces ethernet eth1 address 2001:db8:100::1/64

# DHCPv6 in VRF
set service dhcpv6-server shared-network-name VRF-A subnet 2001:db8:100::/64 address-range start 2001:db8:100::100 stop 2001:db8:100::200
set service dhcpv6-server shared-network-name VRF-A subnet 2001:db8:100::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name VRF-A interface eth1

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:100::/64
set service router-advert interface eth1 managed-flag

commit
save

Monitoring and Diagnostics

Viewing active leases

# Show all DHCPv6 leases
show dhcpv6 server leases

# Example output:
# IPv6 address       DUID                                          State
# 2001:db8:1::100    00:01:00:01:12:34:56:78:aa:bb:cc:dd:ee:ff    active

Viewing statistics

# DHCPv6 server statistics
show dhcpv6 server statistics

# Output includes:
# - Number of active leases
# - Available addresses in the pool
# - Pool utilization (%)

Checking the configuration

# Show DHCPv6 configuration
show configuration service dhcpv6-server

# Show Router Advertisement
show configuration service router-advert

DHCPv6 logs

# DHCPv6 server logs
show log | match dhcpv6

# Real-time monitoring
monitor log | match dhcpv6

# Detailed logs (if debug is enabled)
show log dhcp6

Checking the client DUID

On the client (Linux):

# View DUID
cat /var/lib/dhcp/dhclient6.leases | grep ia-na

# Windows PowerShell
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv6Address

# macOS
ipconfig getv6packet en0

Testing from the client

# Linux - request a DHCPv6 address
sudo dhclient -6 -v eth0

# View the obtained address
ip -6 addr show eth0

# View DNS received via DHCPv6
cat /etc/resolv.conf

Checking Router Advertisement

# On the router
show ipv6 route

# Send RA manually (for testing)
sudo radvdump

# On the client (Linux)
ip -6 route show

Troubleshooting

Issue: Clients do not receive IPv6 addresses

Diagnostics:

# 1. Check DHCPv6 configuration
show configuration service dhcpv6-server

# 2. Check Router Advertisement
show configuration service router-advert

# 3. Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding

# 4. Logs
show log | match dhcpv6

# 5. Check the interface
show interfaces ethernet eth1

Solution:

# Make sure managed-flag is set
set service router-advert interface eth1 managed-flag

# Check the address-range
show configuration service dhcpv6-server shared-network-name LAN

# Restart the service (if necessary)
restart dhcpv6 server

commit
save

Issue: DHCPv6 works, but there is no DNS

Cause: DNS is delivered only via DHCPv6 or RDNSS in the RA.

Solution:

# Add name-server in DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888

# Or use RDNSS in Router Advertisement
set service router-advert interface eth1 name-server 2001:4860:4860::8888

commit
save

Issue: Static reservation does not work

Cause: Incorrect DUID.

Diagnostics:

# Check the DUID in the logs
show log | match dhcpv6 | match DUID

# On the client (Linux)
cat /var/lib/dhcp/dhclient6.leases

Solution:

# Use the correct DUID from the logs
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 identifier <correct-duid>
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 ipv6-address 2001:db8:1::10

commit
save

# Renew the lease on the client
# Linux: sudo dhclient -6 -r eth0 && sudo dhclient -6 eth0

Issue: Prefix Delegation does not work

Diagnostics:

# On the server - check the PD configuration
show configuration service dhcpv6-server | match prefix-delegation

# On the client - check dhcpv6-options
show configuration interfaces ethernet eth0 dhcpv6-options

# Logs
show log | match "prefix delegation"

Solution:

# On the server - make sure PD is configured
set service dhcpv6-server shared-network-name WAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56

# On the client - configure PD
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 address 1
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 sla-id 0

commit
save

Issue: DHCPv6 pool exhausted

Diagnostics:

# Check leases
show dhcpv6 server leases

# Utilization statistics
show dhcpv6 server statistics

Solution:

# Expand the address-range
delete service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::500

# Or reduce the lease time
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 3600  # 1 hour

commit
save

Issue: Clients get addresses via SLAAC instead of DHCPv6

Cause: The managed flag is not set in the RA.

Solution:

# Set managed-flag
set service router-advert interface eth1 managed-flag

# Restart RA
restart router-advert

commit
save

# Refresh the configuration on the clients
# Linux: sudo dhclient -6 -r eth0 && sudo dhclient -6 eth0

Best Practices

1. Choosing the right mode

# Managed DHCPv6 - for full control
set service router-advert interface eth1 managed-flag

# Stateless - for simplicity (SLAAC + DHCPv6 parameters)
set service router-advert interface eth1 other-config-flag

2. Reserving addresses for critical services

# Static reservations for servers
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping critical-server identifier <duid>
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping critical-server ipv6-address 2001:db8:1::10

3. Proper pool sizing

Plan the address-range size with some headroom:

# For 100 clients - a pool of 200-300 addresses
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::400

4. DNS configuration

Always configure DNS servers:

set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com

5. Monitoring pool utilization

Check utilization regularly:

show dhcpv6 server statistics

6. Lease time for different scenarios

# Stable network - long lease time
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 86400  # 24 hours

# Guest network - short lease time
set service dhcpv6-server shared-network-name GUEST subnet 2001:db8:30::/64 lease-time default 3600  # 1 hour

7. Documenting static reservations

Document all static mappings:

# Comments in the configuration
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server ipv6-address 2001:db8:1::10
# Web server - Apache, production

8. Security

Use a firewall to protect DHCPv6:

set firewall ipv6 name LAN_LOCAL rule 100 action accept
set firewall ipv6 name LAN_LOCAL rule 100 protocol udp
set firewall ipv6 name LAN_LOCAL rule 100 destination port 546-547

9. Integration with DHCPv4

Maintain dual-stack:

# DHCPv4
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1

# DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200

10. Logging and monitoring

Set up logging for auditing:

set system syslog file dhcpv6.log facility daemon level info

Useful Commands

# Show DHCPv6 leases
show dhcpv6 server leases

# Statistics
show dhcpv6 server statistics

# DHCPv6 configuration
show configuration service dhcpv6-server

# Router Advertisement configuration
show configuration service router-advert

# Logs
show log | match dhcpv6
monitor log | match dhcpv6

# Restart DHCPv6 server
restart dhcpv6 server

# Restart Router Advertisement
restart router-advert

# Check IPv6 connectivity
ping 2001:db8:1::100

# IPv6 routing table
show ipv6 route

# Check interfaces
show interfaces

Integration with Other Features

DHCPv6 + DNS Forwarding

# DHCPv6 points to the local DNS
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:db8:1::1

# DNS Forwarding on the router
set service dns forwarding listen-address 2001:db8:1::1
set service dns forwarding name-server 2001:4860:4860::8888

DHCPv6 + Firewall

# Allow DHCPv6 traffic
set firewall ipv6 name WAN_LOCAL rule 100 action accept
set firewall ipv6 name WAN_LOCAL rule 100 protocol udp
set firewall ipv6 name WAN_LOCAL rule 100 source port 547
set firewall ipv6 name WAN_LOCAL rule 100 destination port 546

DHCPv6 + High Availability

In an HA setup, the DHCPv6 pool must be split between routers or use failover (not yet supported directly in VyOS).

Conclusion

The DHCPv6 Server in VyOS provides full-featured IPv6 addressing management for modern networks. Support for both stateful (managed) and stateless modes, prefix delegation, static reservations, and integration with Router Advertisement make VyOS a powerful platform for IPv6 deployments.

Key benefits of DHCPv6 in VyOS:

Full control over IPv6 addressing
Static reservations for critical devices
Prefix Delegation for hierarchical networks
Integration with SLAAC
Centralized parameter management (DNS, NTP)

Recommendations for production:

Choose the right mode (managed vs stateless)
Plan the pool size with some headroom
Use static reservations for servers
Configure DNS and domain-search
Monitor pool utilization
Document all reservations
Integrate with dual-stack (IPv4 + IPv6)
Apply firewall rules for protection

DHCPv6 in VyOS delivers enterprise-grade management of IPv6 infrastructure with the configuration flexibility and reliability needed for production environments.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Router Advertisements in VyOS