25.11 IPv6 gateway pending
-
I started to use IPv6 recently, so I can't confirm if this behavior is something that was happening in previous pfSense versions.
Info:
Multi WAN DHCP6
Both modems are not in bridge mode.
IPv6 will be used only for management, so no need for NPT, track interface in LAN, IPv6 will only be used for WAN and perhaps for haproxy in the future.Description:
If you boot pfSense at the same time as you boot the modems, pfSense won´t get IPv6 address through DHCP and gateway status will be Pending.
But, if you reboot pfSense again, everything will work.Tried different settings in DHCP6:
Do not wait for a RA
Request a IPv6 prefix/information through the IPv4 connectivity link
Send an IPv6 prefix hint to indicate the desired prefix size for delegationNo changes to the behavior.
I can replicate it everytime.If you need more info, let me know.
Thanks! -
@mcury It is kinda normal I guess.
What happens if you go to WAN-interface and just hit save and apply?
What happens if you wait some time, e.g. an hour? -
Hello Bob.Dig, thanks for answering.
@Bob.Dig said in 25.11 IPv6 gateway pending:
It is kinda normal I guess.
It should't be normal, it should try to renew again after sometime.
What happens if you go to WAN-interface and just hit save and apply?
It works, I get an IPv6 doing that but gateway remains in Pending state, so a restart in dpinger service fixes that and we are good to go.
What happens if you wait some time, e.g. an hour?
It gets stuck forever in pending state with no IPv6 address in my WAN.
Observation:
I'll test a cron script:
@reboot sleep 60 && /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_wan.conf -p /var/run/dhcp6c_wan.pid ix3
@reboot sleep 60 && /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_wan.conf -p /var/run/dhcp6c_wan.pid ix2ix2 and ix3 because it is happening in both WANs.
-
@mcury said in 25.11 IPv6 gateway pending:
/var/etc/dhcp6c_wan.conf
Can you show the content of this file ?
-
@Gertjan said in 25.11 IPv6 gateway pending:
Can you show the content of this file ?
Weird, that file doesn't exist.
[25.11-RELEASE][root@pfSense.home.arpa]/root: cat /var/etc/dhcp6c_wan.conf cat: /var/etc/dhcp6c_wan.conf: No such file or directory [25.11-RELEASE][root@pfSense.home.arpa]/root: cat /var/etc/dhcp6c_ dhcp6c_opt1_dhcp6withoutra_script.sh* dhcp6c_wan_dhcp6withoutra_script.sh* dhcp6c_opt1_script.sh* dhcp6c_wan_script.sh*dead on arrival, nowhere to be found.
-
@mcury said in 25.11 IPv6 gateway pending:
Weird, that file doesn't exist.
Then
@mcury said in 25.11 IPv6 gateway pending:
@reboot sleep 60 && /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_wan.conf -p /var/run/dhcp6c_wan.pid ix3
@reboot sleep 60 && /usr/local/sbin/dhcp6c -d -c /var/etc/dhcp6c_wan.conf -p /var/run/dhcp6c_wan.pid ix2means firing up dhcp6c will fail right away ...
I've no experience what so ever with dual IPv6 WAN using the dhcp6c = dhcp v6 client - I use just one WAN.
For dual or more WAN - I would / could / should do this :
Activate one WAN interface with IPV6 and dhcp6c.
Then rename the file being used ( mine is actually "/var/etc/dhcp6c.conf") to, for example :
/var/etc/dhcp6c-ix2.conf
and use it like this :
Activate now the ix3 WAN IPv6, set it up with dhcp6c, copy the file again, now naming it
/var/etc/dhcp6c-ix3.conf
and use it as shown above, replace ix2 for ix3. -
@Gertjan hmm, trying now.
1- Removed the IPv6 configuration from ix2 by removing it from a gateway group, removing the DNS IPv6 in general setup, then removing it from the interface.
2- Now in ix3 interface, forced to default IPv6 (know working settings), just to get the dhcp6.conf values:Which are:
Send IPv6 prefix hint
Do not wait for a RAinterface ix3 { send ia-na 0; # request stateful address send ia-pd 0; # request prefix delegation request domain-name-servers; request domain-name; script "/var/etc/dhcp6c_wan_dhcp6withoutra_script.sh"; # we'd like nameservers and RTSOLD to do all the work }; id-assoc na 0 { }; id-assoc pd 0 { prefix ::/64 infinity; };Got an IPv6 address in ix3, now I'll create the file /var/etc/dhcp6c_wan_ix3.conf with these settings and set the override config to this file to test.
If all succedes, I'll do the same thing to ix2.
Just as a note, ix2 requires this additional option: Request a IPv6 prefix/information through the IPv4 connectivity link -
hmm, after the changes, boot while watching the console now gives me this:
Configuring NET interface...Error: cannot open dhcp6c.conf in interface_dhcpv6_configure() for writing.
done.
Configuring NATIVE interface...done.
Configuring OI interface...Error: cannot open dhcp6c.conf in interface_dhcpv6_configure() for writing.Weird, because I didn't change this file permission...
[25.11-RELEASE][root@pfSense.home.arpa]/root: ls -lah /var/etc/dhcp6c* -rw-r--r-- 1 root wheel 0B Dec 31 12:02 /var/etc/dhcp6c.conf -rwxr-xr-x 1 root wheel 509B Dec 31 12:02 /var/etc/dhcp6c_opt1_dhcp6withoutra_script.sh -rwxr-xr-x 1 root wheel 300B Dec 31 12:02 /var/etc/dhcp6c_opt1_script.sh -rwxr-xr-x 1 root wheel 509B Dec 31 12:02 /var/etc/dhcp6c_wan_dhcp6withoutra_script.sh -rwxr-xr-x 1 root wheel 300B Dec 31 12:02 /var/etc/dhcp6c_wan_script.shsome logs after messing around saving interfaces:
dhcp6c[89231]: script "/var/etc/dhcp6c_wan_dhcp6withoutra_script.sh" cannot be executed safely 2025-12-31 12:12:59.000 dhcp6c[89231]: dhcp6c[89231]: lstat failed: No such file or directorySame problem now after a cold boot.
-
@mcury said in 25.11 IPv6 gateway pending:
Weird, that file doesn't exist.
The correct full path is
cat /var/etc/dhcp6c.conf -
Correct
I edit my post above.The "/var/etc/dhcp6c.conf" should exist, merely to make pfSense happy.
You should have now :
/var/etc/dhcp6c_wan_ix3.conf
/var/etc/dhcp6c_wan_ix2.confor whatever you called them.
Fir every WAN type interface where djcp6c is used, you should reference (use) one of them.
I'll propose : for the ix3 interface you use the dhcp6c_wan_ix3.conf file. and ix2 for ix2.Btw : it is possible that one dhcp6c instance can handle one file, the default /var/etc/dhcp6c.conf and that the dhcp6c process handles the two interfaces, ix2 and ix3. I guess this is what pfSense resumes ^^ (?)
But if they use different settings among them .... because different upstream hardware or ISP, it's probably better using two separate instances.
If, and you have to test this : if dhcp6c can be run (used) with two instances at the time. -
Credits to Grok (xAI) – Full IPv6 Boot Watchdog Script with Daily Reboot Limit
Thanks to Bob.Dig, Gertjan, and the community for all the help and ideas along the way.
But in the end, I went full nuclear with Grok's help to solve the annoying "IPv6 gateway pending" / DHCPv6 fails at boot issue on 25.11 (and earlier versions) with ixgbe/ix interfaces.Grok helped build, debug, refine, and harden this script over dozens of iterations — from parsing issues in ash, ambiguous redirects, long shutdown delays, false positives, to daily reboot protection and input validation.
Big thanks to Grok for turning a frustrating problem into a reliable workaround!What the script does
- Runs automatically after boot
- Checks if all specified interfaces (
INTERFACES=) have at least one global IPv6 address (2000::/3 range, non-link-local) - If yes → exits cleanly (no reboot)
- If no → waits a timeout period (default 120 s of checking) → reboots pfSense
- Safety: max 2 reboots per calendar day — prevents endless loops if ISP has outage
- Counter resets automatically at midnight
- Manual reset:
rm /var/db/ipv6_watchdog_reboot_count
- Extra: Early exit if any interface is physically down (no carrier)
- Quiet: Logs only important events to syslog (via
logger) — no spam - Robust: Validates config (interfaces exist, no spaces, numbers valid, etc.)
Recommended Installation (fast shutdown, no delays)
- Save the script (anywhere, e.g.
/usr/local/etc/ipv6_watchdog.sh):vi /usr/local/etc/ipv6_watchdog.sh
#!/bin/sh # /usr/local/etc/ipv6_watchdog.sh # IPv6 Global Address Watchdog for pfSense - Built with Grok (xAI) # Daily reboot limit (max 2/day), quiet syslog logging, input validation, early exit if link down # More info at: https://forum.netgate.com/topic/199716/25.11-ipv6-gateway-pending/11?_=1767700010718 # ================= CONFIG ================= TIMEOUT=120 # seconds (min 30) INITIAL_DELAY=60 # seconds (min 10) CHECK_INTERVAL=20 # seconds (min 5) INTERFACES="ix2,ix3" # comma-separated, NO spaces! MAX_REBOOTS_PER_DAY=2 LOG_TO_SYSTEM_LOGS=1 # 1 = syslog (recommended), 0 = file # ================= VALIDATION & LOGGING ================= validate_positive_int() { local var="$1" name="$2" min="${3:-1}" if ! echo "$var" | grep -qE '^[0-9]+$'; then logger -t ipv6_watchdog "ERROR: $name must be positive integer (got '$var')" exit 1 fi if [ "$var" -lt "$min" ]; then logger -t ipv6_watchdog "ERROR: $name >= $min (got $var)" exit 1 fi } validate_positive_int "$TIMEOUT" "TIMEOUT" 30 validate_positive_int "$INITIAL_DELAY" "INITIAL_DELAY" 10 validate_positive_int "$CHECK_INTERVAL" "CHECK_INTERVAL" 5 validate_positive_int "$MAX_REBOOTS_PER_DAY" "MAX_REBOOTS_PER_DAY" 1 if [ "$LOG_TO_SYSTEM_LOGS" != "0" ] && [ "$LOG_TO_SYSTEM_LOGS" != "1" ]; then logger -t ipv6_watchdog "ERROR: LOG_TO_SYSTEM_LOGS must be 0 or 1" exit 1 fi if [ -z "$INTERFACES" ]; then logger -t ipv6_watchdog "ERROR: INTERFACES is empty" exit 1 fi if echo "$INTERFACES" | grep -q '[[:space:]]'; then logger -t ipv6_watchdog "ERROR: INTERFACES contains spaces (use 'ix2,ix3')" exit 1 fi OLD_IFS="$IFS"; IFS=','; set -- $INTERFACES; IFS="$OLD_IFS" for iface; do iface=$(echo "$iface" | tr -d '[:space:]') if ! ifconfig "$iface" >/dev/null 2>&1; then logger -t ipv6_watchdog "ERROR: Interface '$iface' does not exist" exit 1 fi done # ================= DETECTION ================= has_global_ipv6() { local iface="$1" local addrs addrs=$(ifconfig "$iface" 2>/dev/null | grep 'inet6 ' | grep -v 'fe80::' | \ sed -E 's/.*inet6[[:space:]]+([0-9a-fA-F:]+).*/\1/') [ -z "$addrs" ] && return 1 echo "$addrs" | grep -qE '^(2|3)' return $? } # ================= MAIN ================= START=$(date +%s) # Early exit if any interface down for iface; do iface=$(echo "$iface" | tr -d '[:space:]') if ! ifconfig "$iface" 2>/dev/null | grep -q 'status: active'; then logger -t ipv6_watchdog "Interface $iface DOWN → watchdog exiting early" exit 0 fi done current_date=$(date '+%Y-%m-%d') if [ -f "$COUNT_FILE" ]; then read saved_date saved_count < "$COUNT_FILE" 2>/dev/null || { saved_date=""; saved_count=0; } else saved_count=0 fi if [ "$saved_date" != "$current_date" ]; then logger -t ipv6_watchdog "New day ($current_date) → reset count to 0" saved_count=0 fi logger -t ipv6_watchdog "IPv6 watchdog starting (count: $saved_count / $MAX_REBOOTS_PER_DAY)" if [ "$saved_count" -ge "$MAX_REBOOTS_PER_DAY" ]; then logger -t ipv6_watchdog "Daily limit reached ($MAX_REBOOTS_PER_DAY). Skipping today." exit 0 fi sleep "$INITIAL_DELAY" while [ $(( $(date +%s) - START )) -lt "$TIMEOUT" ]; do all_good=1 for iface; do iface=$(echo "$iface" | tr -d '[:space:]') if ! has_global_ipv6 "$iface"; then all_good=0 break fi done [ $all_good -eq 1 ] && exit 0 sleep "$CHECK_INTERVAL" done logger -t ipv6_watchdog "CRITICAL TIMEOUT after ${TIMEOUT}s - no global IPv6" new_count=$((saved_count + 1)) if [ "$new_count" -le "$MAX_REBOOTS_PER_DAY" ]; then logger -t ipv6_watchdog "Rebooting ($new_count of $MAX_REBOOTS_PER_DAY today)" echo "$current_date $new_count" > "$COUNT_FILE" /sbin/shutdown -r now "IPv6 watchdog timeout (daily $new_count/$MAX_REBOOTS_PER_DAY)" else logger -t ipv6_watchdog "Daily limit reached. No reboot today." fi exit 1Make it executable:
chmod +x /usr/local/etc/ipv6_watchdog.shInstall Shellcmd package if not present (System → Package Manager → Available Packages → shellcmd)
Add Shellcmd entry (Services → Shellcmd → Add):Command (paste exactly):/bin/sh -c 'nohup /usr/local/etc/ipv6_watchdog.sh >/dev/null 2>/dev/null' &Customization Tips
Increase TIMEOUT=300 (5 min) if your modem takes longer to restore IPv6
Change INITIAL_DELAY if needed (give more time for interfaces to come up)
Set LOG_TO_SYSTEM_LOGS=0 if you want file logging instead
Add more WAN interfaces if needed: INTERFACES="ix2,ix3,igb0"
Privacy Policy · Cookie Policy