IPv6, SLAAC, DHPv6 and Port Forward

If you have only one LAN, a /64 prefix from the ISP is adequate, as the LAN will hold the whole prefix space.

RA/SLAAC and DHCPv6 are two mostly exclusive ways for a router to tell a client what IP address it should use. In RA, the router tells the client the first 64 bits of it's IP (called the "prefix", but this is a different thing than the "routable prefix" assigned by the ISP). Then the client itself chooses the last 64. Depending on the client capabilities and configuration (which is outside the scope of this forum), the last 64 could be chosen:

  • at random. This is typical for general use as it offers a sort of security by obscurity.
  • a constant based on the interface's factory MAC address. These (known as EUI64s) can be recognized as the 16 bits in the middle are always ff:fe. This is not good for privacy as any site visited will get the client's uniquely assigned MAC, and can thus uniquely identify and track it.
  • a constant configured by the user. That would be the best way to run a server that must always have the same IP.

In DHCPv6, the router also chooses the last 64 and pushes the client's entire 128 bit IP to the client. So a client can have a reserved address like is done with DHCPv4.

In a home network is is probably preferable to use RA only, assuming you have a way to control any server machine's choice of the last 64 so that an incoming firewall exception (allow input to the one server, also possibly only on certain ports) can be configured. This is not a port forward. The IP and port are not modified by the firewall, it is only allowed to pass.

2 Likes