How to resolve issues with IPv6 via PPPoE

IPv6 connectivity failures over PPPoE typically stem from misconfigured firewall rules, incorrect interface binding, or upstream provider limitations. By verifying that the PPPoE interface is correctly assigned to the IPv6 stack and ensuring that stateful inspection rules allow RA (Router Advertisement) and DHCPv6 traffic, you can restore full dual-stack functionality on most modern routers and Linux systems.

Understanding the PPPoE and IPv6 Handshake

To troubleshoot effectively, it is crucial to understand how IPv6 operates within a Point-to-Point Protocol over Ethernet (PPPoE) session. Unlike IPv4, which often relies on Network Address Translation (NAT), IPv6 requires end-to-end connectivity. In a PPPoE environment, this means your router must successfully negotiate an IPv6 prefix delegation or address assignment from the Internet Service Provider (ISP) after the initial L2TP/PPPoE link establishment. The process begins with the PPPoE discovery phase, which is Layer 2 and generally bypasses host firewalls. However, once the session is established, the subsequent IPv6 configuration phases are Layer 3 and Layer 4 events. If your firewall blocks incoming Router Advertisements (RA) or DHCPv6 requests, your device will never receive an IPv6 address or prefix. This is the most common cause of "no internet" symptoms where IPv4 works perfectly but IPv6 shows no connectivity.

Verifying Interface Configuration and Binding

The first step in resolution is confirming that your operating system or router firmware has bound the IPv6 stack to the correct virtual interface. When PPPoE connects, it creates a logical interface (often named ppp0, pppoe-wan, or similar). If the IPv6 settings are applied to the physical Ethernet port (eth0 or enp3s0) instead of the PPPoE virtual interface, traffic will be dropped because the routing table does not know how to reach the ISP's IPv6 gateway through the tunnel. On Linux systems, you can verify this by checking the interface status. Use the command ip -6 addr show to list all configured IPv6 addresses. Look for an address associated with the PPPoE interface name. If the address is missing, check the network manager configuration files. For systemd-networkd, ensure the .network file specifies IPv6=yes and DHCP=ipv6. For NetworkManager, verify via nmtui that the specific PPPoE connection profile has IPv6 set to either "Automatic" or "Link-local only" depending on ISP support. If you are using a consumer router, navigate to the WAN or Internet settings. Ensure that the PPPoE profile explicitly enables IPv6. Some routers default to IPv4-only modes for backward compatibility. You may need to switch the IPv6 mode from "Disable" to "Native" or "Passthrough." Note that if your ISP uses SLAAC (Stateless Address Autoconfiguration), you do not need a static IP; the router should request a prefix automatically.

Firewall and Security Software Interference

Host-based firewalls are frequent culprits for blocking IPv6 traffic. Windows Defender Firewall, iptables, nftables, and third-party security suites often have separate rule sets for IPv4 and IPv6. It is a common misconception that disabling the IPv4 firewall disables IPv6 as well; they are independent. For Linux users utilizing iptables, remember that iptables manages IPv4 traffic, while ip6tables manages IPv6. A rule allowing all inbound traffic on IPv4 might leave IPv6 completely blocked. Check your input chains with sudo ip6tables -L -n. If you see a DROP or REJECT policy without explicit ACCEPT rules for ICMPv6 (specifically types 133, 134, and 135 for Neighbor Discovery and Router Solicitation/Advertisement), you must add them. These ICMPv6 packets are essential for IPv6 operation and cannot be spoofed, so allowing them is safe and necessary. Windows users should inspect their Advanced Firewall settings. Navigate to IPv6-specific inbound rules and ensure that "ICMPv6 – Destination Unreachable" and "ICMPv6 – Packet Too Big" are enabled. Additionally, some antivirus software includes a "Network Shield" that inspects traffic at the packet level. Temporarily disable this feature to test if it is dropping DHCPv6 responses. If connectivity returns, add an exception for the PPPoE interface or the specific DHCPv6 port (UDP 546/547).

Testing Connectivity and Diagnostics

Once configuration and firewall settings are verified, perform active diagnostics to isolate remaining issues. Start by pinging a public DNS server using IPv6. For example, ping -6 2001:4860:4860::8888 (Google DNS). If this fails, the issue is likely upstream or related to prefix delegation. If it succeeds but general web browsing fails, the problem may be MTU (Maximum Transmission Unit) mismatch. PPPoE adds an 8-byte header to Ethernet frames, reducing the standard MTU from 1500 to 1492 bytes. If your local network devices use a larger MTU, packets will be fragmented or dropped. Test this by pinging with the "Do Not Fragment" flag set: ping -6 -M do -s 1472 2001:4860:4860::8888. If this ping fails, lower your MTU setting on the PPPoE interface to 1492 or 1480. Check your routing table with ip -6 route. Ensure there is a default route (default via <gateway_ip> dev ppp0) pointing to the PPPoE interface. If multiple interfaces exist (e.g., Wi-Fi and Ethernet), ensure the metric is correct so IPv6 traffic prefers the correct path. Finally, review your ISP's status page or contact support to confirm that IPv6 service is provisioned on your account. Some ISPs require a specific client ID or VLAN tag for IPv6 to function, which differs from the standard PPPoE credentials used for IPv4.

Advanced Troubleshooting Steps

If basic steps fail, deeper analysis is required. Use tcpdump or Wireshark to capture traffic on the PPPoE interface. Filter for icmp6 to see if Router Advertisements are arriving from the ISP. If RAs are present but no address is assigned, check your DUID (DHCP Unique Identifier). Some ISPs bind prefixes to specific DUIDs; changing your MAC address or DUID can sometimes resolve stale lease issues. Additionally, verify that your router is not acting as a bridge. Bridging modes can interfere with PPPoE termination and IPv6 processing. Ensure the router is performing NAT or routing functions appropriately. For enterprise setups, check RADV (Router Advertisement Daemon) logs if you are delegating prefixes to downstream LAN segments. Misconfigured prefix lengths or valid lifetimes can cause devices to reject the delegated range.

Frequently Asked Questions

Why does my IPv6 work when plugged directly into the modem but not through my router?

This usually indicates that your router is not properly handling Prefix Delegation (PD). Many consumer routers require you to explicitly enable "IPv6 Passthrough" or "Bridge Mode" to pass the PD request to the modem, or they must be configured to request a /56 or /64 prefix. Check your router's WAN settings to ensure it is requesting a prefix rather than just a single IP address.

Can I use IPv6 with a dynamic IP address provided by PPPoE?

Yes, IPv6 is designed for dynamic environments. The protocol uses SLAAC or DHCPv6-DP to assign addresses dynamically. As long as your ISP supports IPv6 and your router is configured to accept automatic assignments, you do not need a static IP. The key is ensuring your router sends proper Solicitation messages to renew its prefix lease regularly.

How do I fix MTU issues causing slow IPv6 speeds?

Lower the MTU on your PPPoE interface to 1492 bytes. On Linux, use ip link set dev ppp0 mtu 1492. On Windows, modify the registry or use netsh commands to adjust the NIC MTU. On routers, look for an MTU override setting in the WAN/Internet configuration section. Setting it to 1480 provides a safety margin for potential encapsulation overhead.

Is it safe to block ICMPv6 traffic for security?

No, blocking ICMPv6 entirely breaks IPv6 functionality. Unlike IPv4, where ICMP is less critical, IPv6 relies heavily on ICMPv6 for neighbor discovery, path MTU discovery, and router advertisements. You should only block specific malicious types, such as Echo Requests if you wish to hide your presence, but always allow Neighbor Solicitation and Advertisement packets.

What should I do if my ISP says they support IPv6 but I still get no address?

Verify that your PPPoE username and password are correct, as some ISPs use different credentials for IPv6 sessions. Check if your ISP requires a specific VLAN ID (QinQ tagging) for IPv6 traffic. Contact support to ask if your line has been provisioned for IPv6 on their backend, as this sometimes requires a manual ticket even if advertised as supported.