It is 2:15 AM. Your team just finished deploying dual-stack networking across an internal cluster, and 48 newly provisioned Kubernetes worker nodes are flapping simultaneously. None of them picked up an IPv6 default gateway or DNS resolver.
PagerDuty is blaring on your nightstand. The knee-jerk reaction during an outage like this is trying to stand up a stateful ISC Kea or wide-dhcpv6 server. That is usually a mistake. All your fleet really needs is predictable, self-healing stateless address allocation.
The Router Advertisement Daemon (radvd) solves this cleanly by broadcasting ICMPv6 Router Advertisement (RA) frames. Nodes configure their own global addresses via Stateless Address Autoconfiguration (SLAAC). They pick up recursive DNS servers via RDNSS (RFC 8106). Best of all, your gateway tracks zero client state.
Quick Start (5 min): Get SLAAC and RDNSS Running
When the clock is ticking, you need packets moving right away. Here is how to configure active autoconfiguration on a Debian/Ubuntu or RHEL-based Linux router.
1. Enable IPv6 Forwarding
If the Linux kernel does not forward IPv6 packets, radvd terminates immediately on startup with a fatal log error. Flip the sysctl flag live:
# Apply live in kernel memory
sysctl -w net.ipv6.conf.all.forwarding=1
# Persist across reboots
echo "net.ipv6.conf.all.forwarding=1" | sudo tee /etc/sysctl.d/99-ipv6-forwarding.conf
sudo sysctl --system2. Assign a Static IPv6 Prefix to the LAN Interface
Assign a static address within the target /64 subnet to your internal interface (we use eth1):
sudo ip -6 addr add 2001:db8:1000:1::1/64 dev eth1
sudo ip link set eth1 up3. Install and Configure radvd
# On Ubuntu/Debian
sudo apt-get update && sudo apt-get install -y radvd
# On RHEL/AlmaLinux/Rocky
sudo dnf install -y radvdWrite this battle-tested configuration to /etc/radvd.conf. It drops advertisement intervals down to 3–10 seconds to recover stuck clients fast:
sudo tee /etc/radvd.conf << 'EOF'
interface eth1 {
AdvSendAdvert on;
MinRtrAdvInterval 3;
MaxRtrAdvInterval 10;
AdvManagedFlag off;
AdvOtherConfigFlag off;
prefix 2001:db8:1000:1::/64 {
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr on;
};
RDNSS 2001:db8:1000:1::1 2606:4700:4700::1111 {
AdvRDNSSLifetime 30;
};
};
EOF4. Start and Verify the Service
sudo systemctl restart radvd
sudo systemctl status radvdWithin five seconds, clients on eth1 will construct a global address matching 2001:db8:1000:1::/64. They install your router’s link-local address as their default route and populate local resolver configs.
Deep Dive: How SLAAC and RDNSS Work Under the Hood
Quick fixes put out fires. Understanding the underlying protocol exchanges keeps systems stable under production loads.
The Stateless Architecture
Traditional DHCPv4 and stateful DHCPv6 servers maintain a centralized lease database. They track MAC-to-IP mappings and manage renewal timers. SLAAC flips this model completely: the router acts purely as an informational beacon, delegating IP generation directly to the client. This approach removes single points of failure across large bare-metal fleets and ephemeral container bridges.
Key Configuration Directives
AdvSendAdvert on: Instructsradvdto emit periodic multicast RAs and reply to ICMPv6 Type 133 Router Solicitations within milliseconds.AdvManagedFlag off(M flag): Tells clients not to query a stateful DHCPv6 server for addresses. Flipping this tooncauses clients to request an address lease via DHCPv6 instead.AdvOtherConfigFlag off(O flag): Controls whether clients query stateless DHCPv6 for supplementary parameters like NTP servers or SIP gateways. Leaving both M and O off ensures a purely autonomous SLAAC setup.AdvAutonomous on(A flag inprefix): The core switch for SLAAC. It permits the client to combine the announced 64-bit prefix with its local 64-bit Interface Identifier. The client generates this suffix using either stable EUI-64 or randomized RFC 7217 privacy extensions.RDNSS(RFC 8106): Early SLAAC deployments only pushed routes and prefixes, forcing sysadmins to run parallel DHCPv6 daemons just to hand out DNS servers. Modern Linux, macOS, Windows 10/11, and Android now parse RDNSS and DNSSL payloads directly from the RA frame.
Advanced Usage: Route Priorities, Zero-Downtime Renumbering, and MTU
In redundant topologies, stock defaults will eventually cause asymmetric routing or packet drops.
Zero-Downtime Prefix Migration
When switching upstream transit providers or renumbering a data center, advertise both subnets simultaneously. Set AdvPreferredLifetime to 0 on the retiring prefix. This tells endpoints to keep existing TCP connections alive on the old address while binding all new sockets to the incoming block:
interface eth1 {
AdvSendAdvert on;
MinRtrAdvInterval 30;
MaxRtrAdvInterval 100;
# Incoming primary prefix
prefix 2001:db8:2000:1::/64 {
AdvOnLink on;
AdvAutonomous on;
AdvValidLifetime 86400; # Valid for 24h
AdvPreferredLifetime 14400; # Preferred for 4h
};
# Phasing out legacy block: active connections stay alive, no new sockets
prefix 2001:db8:1000:1::/64 {
AdvOnLink on;
AdvAutonomous on;
AdvValidLifetime 7200; # Drops off after 2h
AdvPreferredLifetime 0; # Deprecated immediately
};
DNSSL internal.infra.local corp.example.com {
AdvDNSSLLifetime 100;
};
};Router Priorities and MTU Clamping
If you run active-passive edge routers on the same Layer 2 segment, configure AdvDefaultPreference. This ensures the secondary node never hijacks outbound traffic:
interface eth1 {
AdvSendAdvert on;
AdvDefaultPreference high; # Accepts: low, medium, high
AdvLinkMTU 1500;
AdvCurHopLimit 64;
};Troubleshooting Triage: Recovering Silent Nodes
When clients fail to obtain a default route or address, run through this triage checklist.
1. Sniff Advertisements with radvdump
Skip guesswork. Use the packet decoder packaged directly alongside the daemon:
sudo radvdumpThe utility binds to all-nodes multicast group ff02::1 and prints real-time RA frames as valid configuration blocks. If the terminal remains blank after 10 seconds, check whether intermediary switches are dropping multicast traffic.
2. Verify ICMPv6 Filtering
Blocking ICMPv4 is sloppy; blocking ICMPv6 is catastrophic. Dropping ICMPv6 breaks Neighbor Discovery Protocol (NDP), Path MTU Discovery, and SLAAC completely.
Ensure both your host firewall and switch ACLs explicitly allow ICMPv6 Types 133 through 136:
# Explicitly permit Router Solicitations and Advertisements
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT
# Explicitly permit Neighbor Solicitations and Advertisements (ARP equivalents)
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT3. Fix the accept_ra Kernel Trap on Multi-Homed Clients
A frequent stumbling block hits Linux systems configured as container hosts or VPN endpoints. If a client has net.ipv6.conf.all.forwarding=1 enabled, the kernel automatically ignores all incoming Router Advertisements. Its accept_ra parameter silently defaults to 0.
Inspect the client interface state:
sysctl net.ipv6.conf.eth0.accept_ra
sysctl net.ipv6.conf.eth0.autoconfForce the client kernel to accept RAs despite being a forwarding node:
sudo sysctl -w net.ipv6.conf.eth0.accept_ra=2Setting accept_ra=2 ensures the interface binds its default route and SLAAC addresses even while forwarding packets across internal bridges and containers.
Commit your /etc/radvd.conf to Git, keep ICMPv6 unblocked across every VLAN, and your IPv6 fleet will autoconfigure reliably without stateful DHCP overhead.
