Intermittent timeouts to dual‑stack websites after enabling DHCPv6 prefix delegation on OpenWrt router

Environment

Home network: OpenWrt 23.05 router acting as DHCPv6 PD client to ISP (WAN obtains /56 via DHCPv6), multiple Linux and iOS clients receive global IPv6 addresses via SLAAC and RA; upstream ISP provides dual‑stack connectivity.

Symptoms

Some users report certain websites intermittently timing out in browsers while others load normally. The issue occurs primarily on IPv6 addresses; forcing IPv4 resolves the timeout for the same web pages.

Observations

tcpdump on router WAN interface shows outbound IPv6 SYN packets for timed‑out sites but no IPv6 SYN‑ACK returned from upstream after some failures. IPv6 connectivity to other sites remains functional. On affected devices, ping6 to the problematic sites sometimes succeeds and sometimes fails within short windows. Restarting the router temporarily clears the issue; router logs show DHCPv6 renewals coinciding with failures in two incidents.

Already attempted

Updated OpenWrt to latest stable, rebooted router and clients, disabled DHCPv6 PD to force NAT64/IPv4-only operation (which removed the problem), increased RA lifetime in config (no durable change), cleared neighbor table on router. Did not modify upstream ISP equipment.

Question

What are the likely network‑level causes for intermittent IPv6 timeouts after enabling PD, what safe tests can I run to narrow the issue, and what configuration or escalation steps will restore reliable IPv6 pathing?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

ISP performing prefix renumbering/PD changes without stable route propagation to peers 85%

Upstream router or carrier NAT issues where delegated prefix is not routed consistently across ISP routers 80%

Router firewall or NAT rules blocking ICMPv6 (needed for PMTU, NA/NS) causing some IPv6 flows to stall 30%

Summary

Intermittent IPv6 reachability after enabling PD often stems from one or more of: 1) the ISP changing delegated prefixes without informing the router, leaving stale routes on the Internet or in upstream routers; 2) ICMPv6 being blocked or rate‑limited somewhere causing PMTU/Path MTU discovery failures; 3) RA/ND configuration on the router creating inconsistent address advertisements; or 4) a transient forwarding problem at the ISP or a misconfigured firewall on the router dropping traffic for newly announced prefixes. The temporary fix after reboot suggests state or cache invalidation clears the problem, consistent with stale prefix bindings or neighbor/route cache issues.

Suggested Fixes

Diagnostic step 1

On a client and on the router, capture packet traces during a reproduce: tcpdump -i <iface> icmp6 or tcp port 80,443 to observe whether SYNs are leaving and whether any ICMPv6 'Packet too big' or 'Destination unreachable' messages are returned.

Diagnostic step 2

Verify router firewall allows ICMPv6 type 1 (destination unreachable) and type 2 (packet too big), and that RA/ND are configured with reasonable lifetimes (prefer longer valid/preferred values during PD tests).

Diagnostic step 3

Enable prefix‑change logging on router and record timestamps of DHCPv6 PD events; if PD renumbering correlates with outages, capture DHCPv6 exchange and contact ISP with logs (escalate to ISP support with PD lease and WAN packet captures).