IPv6 foundations: RA, SLAAC, and DHCPv6

An IPv6 router sends ICMPv6 Router Advertisements. They announce that a prefix is present on a link, identify the default router, provide lifetimes, and may advertise DNS through RDNSS. Hosts can learn how to reach the Internet even when no DHCPv6 server assigns their address.

Router Advertisement
  prefix: 2001:db8:10::/64
  preferred lifetime: 86400
  valid lifetime: 172800
  default router: this link
  flags: managed/other information as configured

With SLAAC, a host combines the advertised /64 prefix with an interface-generated identifier. It may create stable and temporary privacy addresses. The host also installs a default route learned from RA. That is why blocking all ICMPv6 can break an apparently unrelated web connection.

• A prefix tells the host which addresses belong on the link.
• RA supplies the default-router information.
• SLAAC forms addresses; it is not the same thing as DHCPv6.
• A globally routed address still needs firewall policy.

The Managed, or M, flag asks clients to use stateful DHCPv6 for addresses. The Other, or O, flag asks for other DHCPv6 information such as DNS. A network can use SLAAC alone, SLAAC plus stateless DHCPv6, or stateful DHCPv6 alongside RA. Client behavior varies, so test real operating systems rather than relying on one diagram.

An IPv6 host often has several legitimate addresses on one interface: a link-local fe80:: address, one or more stable global addresses, and temporary privacy addresses. The useful question is which source address and route the kernel selects for the destination you care about. A public AAAA record must point to a stable address that your firewall and return route support; it should not casually point to an expiring privacy address.

# Which IPv6 source address and route will this host really use?
ip -6 route get 2606:4700:4700::1111

# See preferred/valid lifetimes as well as addresses.
ip -6 addr show dev eth0

# A default route learned from RA often uses a link-local next hop.
ip -6 route show default

# Watch the actual RA/Neighbour Discovery exchange while a client joins.
tcpdump -ni eth0 'icmp6 and (ip6[40] == 134 or ip6[40] == 135 or ip6[40] == 136)'

A default route via fe80:: is normal. Link-local addresses are valid only on their named interface, which is why routes show both the next hop and dev eth0. Do not publish fe80:: addresses in public DNS and do not attempt to use one without its interface scope.