How to control access using ipv6?

[jmaurin]

Hi!
In ipv4, I'm using NAT to isolate my LAB using invalid ip range and control internet access for some clients (captive portal). Since with IPv¨clients get valid ipv6 and direct internet access, how do I control these access? How should I split my networks for LAN and WAN? I mean, should I use one /64 for each? Then the default GW of LAN should be IP of my pfsense? And if client just change default GW?

[cmb]

The same way you do with IPv4, via firewall rules. NAT doesn't control what can get where in v4 either (though I guess the lack thereof could, that's not the right way to do it), firewall rules do.

[awebster]

jmaurin points out that he was thinking of using captive portal.  Last I'd tried, it didn't work with IPv6.  Is this fixed (or on the roadmap to be fixed) in 2.3 or later?

[cmb]

Captive portal blocks all IPv6 at this time. No immediate plans to add support for it.