I can also ping6 the xfinity box's link-local gateway from the Protectli through enp1 (obviously). I am able to ping6, and ipv6 only websites work just fine.

With ipv6 set (again, using the GUI network manager) to 'Automatic' or 'Manual' (using static ipv6 addresses), ipv6 works great when working directly on the Protectli. Don't seem to need any FORWARD rules to get ipv4 working just fine everywhere. to allow forwarding from * to the WAN (enp1) for ipv4. Iptables AND ip6tables rules are all using the default policy of ACCEPT, and the only rule I've added is this: iptables -t nat -A POSTROUTING -o enp1 -j MASQUERADE In /etc/nf I have enabled both ipv4 and ipv6 forwarding with: _forward=1 And yes, I have set it to be the authoritative dhcp server. (I am setting all this up through the GUI, NOT in /etc/network/interfaces.) /etc/dhcp/nf sets up the DHCP range on the LAN to be 192.168.19.100 - 192.168.19.120. The Xfinity LAN is 10.0.0.0/24, with the gateway being 10.0.0.1.Įnp2 on the Protectli creates a LAN running isc-dhcp-server, with the static address of 192.168.19.1, and the gateway - enp1 at 10.0.0.20. On the Proctectli, I'm connecting enp1 as the WAN via hardwire directly to the xfinity modem with static IP of 10.0.0.20. So I know that ipv6 can be successfully routed from the xfinity box (or at least 'passed through') to subnets. Comcast (xfinity) is delegating /64 ipv6 to me, and setting up subnets on Linksys routers with ipv6 set to 'pass-through' works great. I'm setting up a new firewall/router on a Protectli appliance with 4 Gbit interfaces, running Ubuntu 18.04.

Protectli router