IPv6 prefix delegation home setups live or die on one number: the size of the prefix your ISP delegates. With a /56 you get 256 separate /64 subnets, which is exactly enough to give every VLAN its own network and never think about it again. Prefix delegation is the DHCPv6 mechanism where your router does not just request an address — it requests a whole block, then subdivides it across your segments.
This is the single concept that makes per-VLAN IPv6 possible, and it is the one that quietly fails when an ISP is stingy. I run a delegated prefix carved across seven VLANs at home, so let me walk through how the request works, what size you actually need, and what to do when your ISP hands you less than you hoped.
What Prefix Delegation Actually Is
In IPv4, your router gets one public address and that is the end of the conversation. In IPv6, your router sends a DHCPv6 message with an Identity Association for Prefix Delegation (IA_PD), the DHCPv6 mechanism defined in RFC 8415, — it is asking the ISP to delegate a routable block that the router itself will then route internally. The ISP records “this block lives behind this customer’s router,” and from then on traffic to any address in that block is sent to you.
That is the magic: you are not bridging the ISP’s network into your house, you are being routed a block that is yours to subdivide. Your router becomes the boundary that splits the delegation into per-link /64s. This is why IPv6 at home feels different — you are operating a small routed site, not hiding behind a single shared address. The trade is that you depend entirely on the ISP delegating a block big enough to subdivide.
The Prefix Sizes and What Each One Buys You
Prefix size is written as a slash and a number, and smaller numbers mean bigger blocks. A /64 is one subnet — the smallest unit SLAAC can use. Everything larger is measured in how many /64s it contains. A /60 holds 16 subnets, a /56 holds 256, and a /48 holds 65,536. For a home network you want enough /64s to cover every VLAN you have plus room to grow.
| Delegated prefix | Number of /64 subnets | Home verdict |
|---|---|---|
| /48 | 65,536 | Generous, more than any home needs |
| /56 | 256 | Ideal — one /64 per VLAN with huge headroom |
| /60 | 16 | Workable for a modest VLAN count |
| /64 | 1 | Cannot be subdivided — breaks per-VLAN IPv6 |
My target is always a /56. It maps cleanly to a home with a handful of VLANs, leaves room for new segments, and keeps the math simple: prefix ID 0 through 255, one per subnet. A /60 works if you only have a few VLANs. A single /64 is the problem case, and it deserves its own section below.
How To Request the Delegation
On the WAN interface you configure two things: the address request (DHCPv6) and the prefix delegation request. In OPNsense you set the IPv6 WAN to DHCPv6 and then set a prefix delegation size — this is you telling the ISP what block size to delegate. Many setups also send a prefix hint, which politely asks for a specific size. Some ISPs honor the hint, some ignore it and give a fixed size regardless.
Once the WAN has the delegation, each internal interface is set to track the WAN and pull a /64 out of the block by prefix ID. That prefix ID is the index into your block: ID 0 is the first /64, ID 1 the second, and so on. I assign them deliberately and write them down, because a firewall rule that references “the IOT network” needs to map to a known, fixed /64. The exact clicks are in the OPNsense IPv6 configuration guide, and the whole thing fits inside the IPv6 home network setup guide.
How I Map Prefix IDs to VLANs
The prefix ID is just a hex index into your delegated block, but the discipline around it is what keeps a multi-VLAN rollout sane. In my setup the IDs follow the VLAN numbering so I never have to guess: MANAGEMENT is prefix ID 0, LAN 1, WORK 2, KIDS 3, GUEST 4, IOT 5, and LAB 6 — seven /64s carved from one /56, with 249 subnets left spare. I keep that mapping in the same notes file as my VLAN tags and DHCP scopes, because the moment you write a firewall rule against “the IOT /64” you need that number to be fixed and known.
The one gotcha that trips people up exactly once: prefix IDs are hexadecimal, so a /56 runs ID 0 through ff, not 0 through 255 in the OPNsense field — past ID 9 you are typing a, b, c. Pick low, memorable IDs that mirror your VLAN tags and you will never fight it again.
When Your ISP Only Gives a /64
This is the wall people hit. If your ISP delegates a single /64, you cannot give each VLAN its own subnet — there is only one. You have three imperfect options. You can run IPv6 only on your main LAN and leave other VLANs IPv4-only, which is the honest, simple choice. You can use ULA addresses internally for the other segments and accept that they have no native global v6. Or you can ask the ISP for a larger delegation, which sometimes works with a support call and sometimes does not.
What you should not do is try to bridge the single /64 across VLANs, because that defeats the segmentation you built the VLANs for. If per-VLAN IPv6 matters to you and your ISP is stuck at /64, that is a legitimate reason to weigh switching ISPs or staying IPv4-internal — and it is exactly the kind of thing to know before you commit, which the cost-benefit take covers.
The Renumbering Problem
Delegated prefixes are not always permanent. Some ISPs keep yours stable for years; others rotate it on reconnect or on a schedule. When the prefix changes, every global address in your house changes with it — which breaks any internal DNS record or firewall rule that referenced a specific global address. This is the strongest argument for running ULA alongside your delegated GUA: ULA addresses (RFC 4193) are locally assigned and never change, so your internal references stay stable while the global side renumbers underneath them.
I point internal DNS and inter-VLAN rules at ULA, and let GUA handle the actual internet path. When my prefix rotates, nothing internal notices. If you skip this, a prefix change turns into an afternoon of fixing references that suddenly point at addresses that no longer exist.
Verifying the Delegation Worked
After configuring, confirm three things in order. First, the WAN shows a delegated prefix, not just a single address — if it shows only a /128 link address, the IA_PD request did not succeed. Second, each tracked interface has pulled its own /64 with the prefix ID you assigned. Third, a client on a VLAN actually receives a global address in that /64 and can reach the IPv6 internet. If the WAN has the delegation but interfaces show nothing, the track-interface and prefix-ID settings are where to look. This same verification chain is the first step in dual-stack troubleshooting, and it connects to the broader reachability picture in the CGNAT and double-NAT guide.
Frequently Asked Questions
What IPv6 prefix size should I ask my ISP for?
A /56 is the sweet spot for home use, giving you 256 separate /64 subnets, one per VLAN with plenty of headroom. A /48 is even larger but more than any home needs. A /60 (16 subnets) works for a small VLAN count. Avoid being stuck with a single /64.
Why can’t I subnet a single /64?
A /64 is the smallest network IPv6 SLAAC supports, because the address format reserves the lower 64 bits for the interface identifier. Splitting a /64 into smaller pieces breaks SLAAC. To give multiple VLANs their own IPv6 networks you need a delegation larger than /64.
What is a prefix hint in DHCPv6-PD?
A prefix hint is your router asking the ISP for a specific delegation size, such as a /56. Some ISPs honor the hint and delegate that size; others ignore it and hand out a fixed size regardless. It is worth setting, but do not rely on it being granted.
How do I give each VLAN its own IPv6 subnet?
Configure the WAN to request a prefix delegation, then set each internal interface to track the WAN and pull a /64 by prefix ID. Prefix ID 0 is the first subnet, ID 1 the second, and so on. Assign them deliberately and record the mapping.
What happens when my ISP changes my IPv6 prefix?
Every global IPv6 address in your network changes with the prefix, which breaks internal DNS records and firewall rules that referenced the old global addresses. Running ULA addresses internally alongside your delegated prefix keeps internal references stable through a renumbering event.
Can I use prefix delegation behind CGNAT?
Yes, and it is often the point. An ISP that CGNATs your IPv4 may still delegate a proper IPv6 prefix, giving you globally routable addresses that CGNAT denies you on IPv4. Check whether your ISP delegates a usable IPv6 prefix before assuming you are stuck.
How do I check if my prefix delegation succeeded?
Confirm the WAN shows a delegated prefix rather than only a single link address, that each tracked interface pulled its own /64 by prefix ID, and that a client receives a global address and reaches the IPv6 internet. If the WAN has the block but interfaces are empty, check the track settings.
Related Guides
- IPv6 at Home, Demystified: A Practical Setup Guide
- IPv6 on OPNsense: WAN, LAN, and Per-VLAN Configuration
- DHCPv6 vs SLAAC: How IPv6 Hands Out Addresses
- Should You Even Enable IPv6 at Home?
- Escaping CGNAT and Double-NAT to Get Reachable
- Dual-Stack Troubleshooting When IPv6 Breaks Sites